harness-init

The fragment is a permission-automation proposal, not evident malware. Its main risk is weakening approval controls, especially because allowedTools includes unrestricted Bash while the command-specific restrictions are only documented separately. Review the actual Claude Code configuration semantics before deployment, use a project-relative path, and enforce a verified command allowlist. No credential theft, exfiltration, destructive command execution, or persistence is shown.