design-harness-agent-skill
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONINGDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the user to clone code from a repository that does not belong to a trusted vendor (https://github.com/tigerless-labs/design-harness).
- [COMMAND_EXECUTION]: The agent is instructed to run a shell command to execute a local Python script (build_canvas.py) located within the untrusted repository. This script performs file system operations to generate a visual canvas.
- [METADATA_POISONING]: There is a significant discrepancy between the declared author (reason-machines), the skill's internal attribution (ara.so), and the source repository (tigerless-labs), which may mislead users about the skill's provenance.
- [DYNAMIC_EXECUTION]: The skill provides Python code snippets for the agent to implement and run locally for parsing markdown and managing logs, which constitutes runtime execution of generated logic.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external research material.
- Ingestion points: Content is read from external URLs and PDF files to create source cards in the workspace.
- Boundary markers: No explicit delimiters or instructions are provided to ensure the agent ignores embedded instructions within the source material.
- Capability inventory: The agent has the ability to execute shell commands and modify local files.
- Sanitization: The skill does not include instructions for sanitizing or validating content extracted from external research material before it is used in the synthesis of design deliverables.
Audit Metadata