harness-update
Fail
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill executes remote shell scripts by fetching them via curl and piping the output directly into the bash interpreter.
- Evidence:
curl -fsSL https://raw.githubusercontent.com/Rheinmir/setup/orca/harness/poc-vendor-neutral/bootstrap.sh | bashin SKILL.md. - [REMOTE_CODE_EXECUTION]: The skill downloads a remote repository and immediately executes a shell script located within the downloaded content.
- Evidence:
git clone -q --depth 1 -b orca git@github.com:rheinmir/setup.git /tmp/llmwiki-tpl && bash /tmp/llmwiki-tpl/harness/scripts/install-harness.sh . --self-healin SKILL.md. - [EXTERNAL_DOWNLOADS]: The skill is designed to download resources, including templates and framework components, from the author's GitHub organization (
Rheinmir). - [COMMAND_EXECUTION]: The skill performs various local command executions to manage the framework, including running installation scripts (
install-harness.sh) and building capability maps (build-capabilities.py).
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Rheinmir/setup/orca/harness/poc-vendor-neutral/bootstrap.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata