harness-executor

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the Python subprocess module with shell=True in several scripts, including validate.py, verify.py, and preflight.py. This is used to run project-specific build, lint, and test commands which are necessary for the skill's core functionality.
  • [EXTERNAL_DOWNLOADS]: The preflight.py script contains installation suggestions for well-known developer utilities like Bun and UV. These suggestions use official installation scripts from bun.sh and astral.sh respectively.
  • [REMOTE_CODE_EXECUTION]: The compile_trajectory.py script implements a 'Harness-as-Policy' feature that generates bash scripts based on successful past task executions recorded in the project's memory. It also uses eval to execute validation commands defined in these procedures.
  • [CREDENTIALS_UNSAFE]: The preflight.py and verify_action.py scripts reference sensitive local file paths (such as .env, credentials.json, secrets.yaml, and SSH keys). These references are part of environment readiness checks and protective rules designed to prevent the AI agent from accidentally modifying or deleting sensitive project secrets during task execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 01:20 AM
Security Audit — agent-trust-hub — harness-executor