init-dev-harness-agents
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides an automated framework for setting up a development harness. It generates structured Markdown and YAML files to define agent interactions based on local project context.
- [SAFE]: The tool performs local analysis of project metadata, such as package.json and directory structures, to configure the technical environment. It does not perform network operations to transmit this data externally.
- [COMMAND_EXECUTION]: The skill utilizes git commit to save and version the generated configuration files, which is a standard procedure for development infrastructure setup tools.
- [PROMPT_INJECTION]: The initialization process relies on project-specific documentation (e.g., README files) to deduce project goals, creating an indirect prompt injection surface.
- Ingestion points: Reads package.json, README.md, and project directory structures.
- Boundary markers: The skill uses template placeholders for metadata but lacks specialized delimiters to prevent embedded instructions from influencing agent role definitions.
- Capability inventory: File-system writes, git commit execution, and the ability to orchestrate subsequent agent tasks through the generated workflows.
- Sanitization: No explicit sanitization or filtering of external project documentation is described before the content is interpolated into configurations.
Audit Metadata