harness-executor
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the Python
subprocessmodule withshell=Truein several scripts, includingvalidate.py,verify.py, andpreflight.py. This is used to run project-specific build, lint, and test commands which are necessary for the skill's core functionality. - [EXTERNAL_DOWNLOADS]: The
preflight.pyscript contains installation suggestions for well-known developer utilities like Bun and UV. These suggestions use official installation scripts frombun.shandastral.shrespectively. - [REMOTE_CODE_EXECUTION]: The
compile_trajectory.pyscript implements a 'Harness-as-Policy' feature that generates bash scripts based on successful past task executions recorded in the project's memory. It also usesevalto execute validation commands defined in these procedures. - [CREDENTIALS_UNSAFE]: The
preflight.pyandverify_action.pyscripts reference sensitive local file paths (such as.env,credentials.json,secrets.yaml, and SSH keys). These references are part of environment readiness checks and protective rules designed to prevent the AI agent from accidentally modifying or deleting sensitive project secrets during task execution.
Audit Metadata