okr-harness
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The orchestrator logic utilizes shell-like commands such as 'ls -1 .okr/' to perform state discovery and detect unauthorized files within the local workspace.
- [DATA_EXFILTRATION]: The tracking workflow includes 'sync pull' and 'sync push' operations for synchronizing OKR data with external sources, which represents a potential network data movement pattern.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting the full content of local markdown files to influence its orchestration logic.
- Ingestion points: Reads the entire body of '.okr/resources.md', '.okr/lessons/index.md', and '.okr/context/index.md'.
- Boundary markers: The logic does not specify the use of prompt delimiters or instructions to ignore embedded directives in the ingested content.
- Capability inventory: The agent has the capability to read/write files and perform network-based synchronization.
- Sanitization: The files reference 'quality gates' in a shared skill, but no explicit sanitization or validation of the ingested file content is provided in the orchestrator.
- [REMOTE_CODE_EXECUTION]: The orchestrator implements dynamic logic execution by reading and processing internal 'SKILL.md' files at runtime based on the detected user intent and system state.
Audit Metadata