harness-spec-anatomy
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill serves as a reference guide for authoring Hedera Harness recipes and provides a shell script for local validation.
- [COMMAND_EXECUTION]: The skill includes a shell script (
scripts/check-spec.sh) that validates project configuration files. It uses standard system utilities likegrep,awk, andsed, and may execute thehedera-harnessCLI tool if it is available in the user's environment. These operations are conducted locally and are transparently documented as part of the skill's linting functionality. - [INDIRECT_PROMPT_INJECTION]: The validation script reads and analyzes user-authored project files (such as PRDs and recipe YAMLs) to ensure cross-file coherence. This analysis is limited to text-matching and basic parsing, with no evidence of dangerous interpolation or execution of instructions contained within the ingested data.
Audit Metadata