harper-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a documentation resource providing best practices for the Harper database platform. It does not contain executable scripts or malicious patterns.\n- [COMMAND_EXECUTION]: The skill documents the use of standard development CLI tools, such as
npm create harper@latestfor project initialization andharper deployfor application deployment to the Harper Fabric cloud.\n- [EXTERNAL_DOWNLOADS]: The instructions include examples of fetching data from external APIs (e.g.,official-joke-api.appspot.comandapi.example.com) and deploying code from GitHub repositories (e.g.,github.com/HarperFast/*). These are documented as standard development practices within the Harper ecosystem and involve vendor-owned or common example resources.\n- [CREDENTIALS_SAFE]: The documentation mentions authentication flows using JWT and Basic Auth, but uses safe placeholders likeYOUR_CLUSTER_USERNAMEand refers to secure practices like using environment variables and encrypted secrets stores.\n- [DYNAMIC_EXECUTION]: The guide explains Harper's internal module loading mechanisms (VM contexts) and security restrictions on subprocess spawning (allowedSpawnCommands), which are part of the platform's security architecture rather than a vulnerability in the skill itself.
Audit Metadata