ecl-harness-engineer
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands to discover project state, run build tools (go build, npm build), execute tests (pytest, go test), and perform linting. These are standard developer operations.
- [DYNAMIC_EXECUTION]: The skill is designed to generate scripts (Bash, PowerShell, Python, JavaScript) and immediately execute them to verify the 'Agent Harness' integrity. This includes generating linter code and running it via 'go run' or 'ts-node'.
- [DYNAMIC_CONTEXT_INJECTION]: Phase 1.1 of the main skill uses shell-command execution blocks to populate environment variables like file counts and project stacks. These commands are localized to 'find', 'wc', 'test', and 'ls' for repository discovery.
- [DATA_EXPOSURE_&_EXFILTRATION]: The skill includes instructions to scan for sensitive variables (PASSWORD, SECRET, KEY) to ensure they are not hardcoded. It explicitly recommends best practices such as using .env files and environment variable references (${VAR}) to handle secrets securely.
- [PRIVILEGE_ESCALATION]: The skill references 'powershell -ExecutionPolicy Bypass' to facilitate running lifecycle scripts on Windows environments. This is a common developer pattern for local script execution and is not being used for unauthorized privilege gain.
- [PERSISTENCE]: The skill implements an 'Auto-Evolve' mechanism that tracks archived changes in 'harness/evolution/state.json' and generates new instructions ('pending.md') when thresholds are met. This acts as a persistent state-tracking and self-improvement loop for the repository infrastructure.
Audit Metadata