harness-self-improve
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses the user's private conversation history and session transcripts in the ~/.claude/ directory. While these interaction logs are sensitive, the skill lacks network capabilities and includes privacy instructions to avoid quoting secrets or private content.\n- [PROMPT_INJECTION]: Subject to indirect prompt injection from historical data processed during the discovery phase. Malicious instructions embedded in past conversations could influence the generation of new automations. Findings: 1. Ingestion points: ~/.claude/history.jsonl and project-specific session logs. 2. Boundary markers: Absent. 3. Capability inventory: Creates files in ~/.claude/ skills/agents/commands directories and modifies settings.json. 4. Sanitization: Includes a privacy rule for secrets but lacks validation for instruction-based content.\n- [COMMAND_EXECUTION]: Instructs the agent to create automation hooks and cron jobs that modify the settings.json configuration file, enabling persistent execution of newly packaged logic.
Audit Metadata