The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes several external shell scripts located in the scripts/ directory, including harness-bootstrap.sh, start-auto.sh, and harness-daemon.sh. The contents of these scripts are not provided in the skill definition, posing a risk of arbitrary code execution.
[PRIVILEGE_ESCALATION]: The PERMISSION_SETUP.md file provides instructions to bypass agent security guardrails by recommending the use of --permission-mode acceptEdits and the /allow-edit command. This disables the requirement for user approval before the agent modifies files.
[PERSISTENCE]: The skill automatically launches a background daemon (harness-daemon.sh) and tmux sessions. This creates a persistence mechanism that allows code to continue running independently of the initial agent session.
[DATA_EXFILTRATION]: The skill harvests user identity data, such as user.name and user.email from the local Git configuration and phone numbers from project files, to populate agent context files like AGENT.md and CLAUDE.md which influence agent behavior.
[COMMAND_EXECUTION]: Extensive use of Bash tools to perform file system operations, directory creation, and system state modification without specific scope limitations.
[INDIRECT_PROMPT_INJECTION]: The skill injects user identity and specific instructions into AGENT.md and CLAUDE.md. These files are ingested by the agent to define its identity and behavior without robust boundary markers or sanitization of the injected data.

harness-init