harness-score
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
metaharnessCLI tool via a subprocess usingnpxto perform analysis on a specified repository path. This is the primary mechanism for generating the readiness scorecard. - [EXTERNAL_DOWNLOADS]: The skill uses
npx, which may fetch themetaharnesspackage from the public npm registry at runtime if it is not available in the local environment. - [DATA_EXPOSURE]: The analysis process involves reading source code and configuration files from the local filesystem at the path provided to the tool to calculate metrics like task coverage and tool safety.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted data from the repository being analyzed.
- Ingestion points: Files within the repository path provided as an argument (e.g., source code, scripts, metadata).
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the analyzed files are defined in the skill instructions.
- Capability inventory: The skill has access to the
Bashtool for subprocess execution. - Sanitization: No specific sanitization or validation of the repository content before analysis is described in the provided markdown.
Audit Metadata