create-pipeline-v1
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate functionality for generating and deploying Harness CI/CD pipelines using the v1 simplified syntax.
- [SAFE]: External references to the pipeline specification are hosted on the author's own GitHub repository (github.com/thisrohangupta/spec).
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted user requirements to generate executable scripts within Pipeline YAML.
- Ingestion points: User requirements provided via trigger phrases such as 'create-pipeline-v1' or 'v1 pipeline' as defined in SKILL.md.
- Boundary markers: Absent; the instructions do not provide delimiters or warnings to the agent to ignore instructions embedded within the user's requirement text.
- Capability inventory: The skill uses the 'harness_create' MCP tool to push generated pipelines (which include shell scripts in 'run' steps) to the Harness platform.
- Sanitization: Absent; there are no instructions to validate, escape, or filter user-supplied text before it is interpolated into the generated 'script' fields.
Audit Metadata