harness-creator
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard shell utilities such as
find,grep, andwc, along with language-specific build tools likego,npm,python, andmake. These commands are used locally to analyze the repository's structure and verify the generated infrastructure, following common development workflows. - [REMOTE_CODE_EXECUTION]: The skill generates local linter scripts and environment setup scripts which are subsequently executed. It also references well-known official Docker images (e.g., PostgreSQL, Redis) for setting up development environments. All execution is transparent and scoped to the project's local development lifecycle.
- [DATA_EXFILTRATION]: Analysis revealed that the skill actively scans for environment variables and potential secrets to ensure they are handled correctly. It explicitly mandates the use of environment variable references (e.g.,
${VAR_NAME}) and forbids hardcoding sensitive data. No patterns indicative of data exfiltration or unauthorized network communication were found. - [PROMPT_INJECTION]: The skill's instructions and sub-agent prompts do not contain any attempts to override system behavior, bypass safety filters, or extract sensitive model information.
Audit Metadata