harness-evolve
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the @metaharness/darwin package from the NPM registry using the npx command.- [COMMAND_EXECUTION]: The skill executes the metaharness-darwin evolve CLI tool through the Bash tool. It includes argument validation for parameters such as repository path, generation limits, and concurrency levels to ensure safe execution.- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external data from repositories, presenting a potential surface for indirect prompt injection. • Ingestion points: Content from the target and the .metaharness/ directory (SKILL.md). • Boundary markers: No explicit delimiters or instructions to ignore embedded data are mentioned. • Capability inventory: Access to shell execution via Bash and file system operations for generating reports (SKILL.md, scripts/evolve.mjs). • Sanitization: The skill validates command-line arguments and verifies the existence of the repository path (SKILL.md).
Audit Metadata