deepseek-harness
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing the
dshCLI tool andpnpmfor operational tasks, launching web/headless surfaces, and maintaining project checkouts across different files (SKILL.md, operation-and-configuration.md). - [REMOTE_CODE_EXECUTION]: Instructions for using
dsh plugin addto install external code are included, which forwards commands directly to thepnpmpackage manager. The skill advises the agent to pin and review dependencies before installation to mitigate supply chain risks (operation-and-configuration.md). - [DYNAMIC_EXECUTION]: The skill references "Dynamic Cordis" code, which allows for runtime-created definitions. The documentation explicitly warns the agent that this capability grants power comparable to host shell code and should not be used as the default distribution mechanism (extension-and-development.md).
- [PRIVILEGE_ESCALATION]: Documentation for the "minimal SDK Profile" states that it omits standard approvals and managed credentials while granting unrestricted process access, suggesting it only for use in disposable environments (operation-and-configuration.md).
- [DATA_EXFILTRATION]: The instructions warn that telemetry features, if enabled, can export unredacted messages, tool arguments, results, and workspace paths to external servers (operation-and-configuration.md).
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface where the agent processes external data from workspaces and session logs while possessing powerful capabilities like command execution and filesystem modification.
- Ingestion points: The agent is instructed to read workspace files, Profile manifests, and session history (SKILL.md).
- Boundary markers: The instructions guide the agent to explicitly identify the target, resolution versions, and name the Harness home and workspace before performing actions (SKILL.md).
- Capability inventory: The agent can execute shell commands, perform filesystem writes for configuration, and conduct network operations via package managers (operation-and-configuration.md).
- Sanitization: There is a strong emphasis on redacting credentials and tokenized URLs from logs and output to prevent accidental exposure (SKILL.md).
Audit Metadata