design-harness-agent-skill
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides installation instructions involving
git clonefrom the author's GitHub repository (tigerless-labs/design-harness).- [COMMAND_EXECUTION]: The skill instructs the agent to run a local Python script (build_canvas.py) to process workspace files and generate an HTML visualization canvas. This execution is confined to the local filesystem and intended for generating visual output from the user's markdown files.- [PROMPT_INJECTION]: The skill ingests untrusted external content (URLs, PDFs) to create 'Source cards'. This attack surface is mitigated by the skill's structured workflow, which requires human approval for synthesized 'Idea cards' and employs structured markdown templates to maintain clear boundaries between processed data and instructions. The code snippets also demonstrate the use ofyaml.safe_loadfor handling metadata safely.
Audit Metadata