ecl-harness-engineer
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
find,grep, andlsto analyze the existing codebase structure and tech stack. These are read-only operations used for discovery and analysis. - [COMMAND_EXECUTION]: The skill generates and executes scripts (
.sh,.ps1,.go) for linting, building, and testing the project. These scripts are created from predefined templates within the skill and are intended to be part of the project's own development lifecycle. - [CREDENTIALS_UNSAFE]: The skill generates test credentials (e.g.,
JWT_SECRET) and configuration files (environment.json). These are clearly identified as development-only test values (e.g., 'test-secret-do-not-use-in-prod') and are managed using standard environment variable interpolation to prevent hardcoding real secrets. - [EXTERNAL_DOWNLOADS]: The skill references and suggests the use of well-known, trusted development tools and libraries from official registries (e.g., Go modules, npm packages, Python packages) and established GitHub organizations like
anthropics/skillsandneondatabase/agent-skills. - [PROMPT_INJECTION]: The skill includes robust guidance for handling ambiguous requirements by using boundary markers like
[NEEDS CLARIFICATION: ...]in generated specifications, which helps prevent agents from executing tasks based on unsafe or incomplete instructions.
Audit Metadata