autonomous-agent-harness
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and configure official MCP servers from a well-known provider's registry.
- Evidence: Recommends installing @anthropic/memory-mcp-server, @anthropic/scheduled-tasks-mcp-server, and @anthropic/computer-use-mcp-server via npx in the setup guide.
- [COMMAND_EXECUTION]: The skill facilitates the creation of persistent scheduled tasks and provides instructions for automated computer control.
- Evidence: Documentation explains how to use the scheduled-tasks-mcp-server for recurring operations and the computer-use-mcp-server for browser and desktop interaction.
- [PROMPT_INJECTION]: The skill establishes an autonomous loop that ingests untrusted data from external sources, creating a surface for indirect prompt injection.
- Ingestion points: The agent is instructed to read content from GitHub PRs, issues, calendar events, and emails.
- Boundary markers: No explicit delimiters or instructions to treat external data as untrusted are present in the provided workflow examples.
- Capability inventory: The system utilizes computer-use capabilities (browser/desktop control) and GitHub write permissions, allowing for significant impact if the agent is manipulated by injected data.
- Sanitization: No sanitization or validation of the ingested external content is mentioned before it is processed by the agent.
Audit Metadata