skills/ruvnet/ruflo/harness-score/Gen Agent Trust Hub

harness-score

Pass

Audited by Gen Agent Trust Hub on Jul 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes the metaharness CLI tool via a subprocess using npx to perform analysis on a specified repository path. This is the primary mechanism for generating the readiness scorecard.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx, which may fetch the metaharness package from the public npm registry at runtime if it is not available in the local environment.
  • [DATA_EXPOSURE]: The analysis process involves reading source code and configuration files from the local filesystem at the path provided to the tool to calculate metrics like task coverage and tool safety.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted data from the repository being analyzed.
  • Ingestion points: Files within the repository path provided as an argument (e.g., source code, scripts, metadata).
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the analyzed files are defined in the skill instructions.
  • Capability inventory: The skill has access to the Bash tool for subprocess execution.
  • Sanitization: No specific sanitization or validation of the repository content before analysis is described in the provided markdown.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 6, 2026, 05:39 PM
Security Audit — agent-trust-hub — harness-score