review-harness-spec
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a validation script (check-spec.sh) and the hedera-harness CLI to perform the audit and run the harness. These tools are local and provided by the same vendor as the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project configuration files, which could contain malicious instructions aimed at influencing the audit report or subsequent command execution.
- Ingestion points: .harness/spec.yaml, .harness/prd.md, .harness/validators/static.json, and .harness/validators/yarn.json (SKILL.md).
- Boundary markers: Absent.
- Capability inventory: Shell script execution via bash and the hedera-harness CLI tool (SKILL.md).
- Sanitization: Absent.
Audit Metadata