pydantic-ai-harness
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes a capability for the agent to generate and load its own functional code during execution.
- Evidence: The RuntimeAuthoring module (pydantic_ai_harness.runtime_authoring) is documented as allowing an agent to "author, validate, and load real capabilities at runtime."
- [REMOTE_CODE_EXECUTION]: The CodeMode feature executes Python scripts written by the AI model.
- Evidence: The run_code tool enables the model to orchestrate multiple tool calls within the "Monty" sandbox. While this sandbox is restricted, it allows for dynamic execution of model-generated logic.
- [COMMAND_EXECUTION]: The skill provides a tool for running system shell commands.
- Evidence: The Shell capability (pydantic_ai_harness.shell) allows for running commands in a subprocess. Mitigation strategies mentioned include allowlists, denylists, and environment variable masking.
- [DATA_EXFILTRATION]: Extensive filesystem access capabilities allow the agent to read and modify host files.
- Evidence: The FileSystem capability (pydantic_ai_harness.filesystem) provides tools to read, write, edit, and search files. When combined with tools that possess network access, this presents a risk of data exposure.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by automatically processing files that may contain attacker-controlled instructions.
- Ingestion points: RepoContext (pydantic_ai_harness.context) automatically loads CLAUDE.md, AGENTS.md, and repository structures into the agent's context.
- Boundary markers: No delimiters or explicit instructions to ignore embedded commands are mentioned for these file ingestion points.
- Capability inventory: Includes shell access, filesystem manipulation, and dynamic code authoring/execution.
- Sanitization: Employs sandboxing for Python execution and allowlists for shell commands to limit the impact of untrusted instructions.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the harness library and its dependencies from public registries.
- Evidence: Instructions specify installation via uv add pydantic-ai-harness and require pydantic-ai-slim>=2.1.0.
Audit Metadata