ecl-harness-engineer

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands like find, grep, and ls to analyze the existing codebase structure and tech stack. These are read-only operations used for discovery and analysis.
  • [COMMAND_EXECUTION]: The skill generates and executes scripts (.sh, .ps1, .go) for linting, building, and testing the project. These scripts are created from predefined templates within the skill and are intended to be part of the project's own development lifecycle.
  • [CREDENTIALS_UNSAFE]: The skill generates test credentials (e.g., JWT_SECRET) and configuration files (environment.json). These are clearly identified as development-only test values (e.g., 'test-secret-do-not-use-in-prod') and are managed using standard environment variable interpolation to prevent hardcoding real secrets.
  • [EXTERNAL_DOWNLOADS]: The skill references and suggests the use of well-known, trusted development tools and libraries from official registries (e.g., Go modules, npm packages, Python packages) and established GitHub organizations like anthropics/skills and neondatabase/agent-skills.
  • [PROMPT_INJECTION]: The skill includes robust guidance for handling ambiguous requirements by using boundary markers like [NEEDS CLARIFICATION: ...] in generated specifications, which helps prevent agents from executing tasks based on unsafe or incomplete instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 09:39 AM
Security Audit — agent-trust-hub — ecl-harness-engineer