validate-harness
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the
harnessCLI tool, thegcloudCLI, and local Node.js scripts. These commands are used to verify authentication states and environment configurations within the local development context without evidence of external exfiltration. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes content from local source files (TypeScript, JavaScript, Rust) and JSON configuration files. This represents an ingestion surface where local project data is processed as part of the validation logic.
- Ingestion points: Local project source code and
.mcp/servers.jsonfiles. - Boundary markers: No specific delimiters or safety instructions are provided to the agent to distinguish between file content and instructions.
- Capability inventory: File system read access, execution of CLI validation tools, and GCP Secret Manager metadata access.
- Sanitization: The instructions do not describe any sanitization, escaping, or filtering of the file contents prior to analysis.
Audit Metadata