create/update agent

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content contains multiple deliberate patterns that enable credential exposure and data exfiltration (echoing connector tokens to pipeline outputs, recommending ngrok/external MCP endpoints, and passing secrets to arbitrary MCP URLs) and grants broad remote capabilities (mcp__* tools, Bash, writing/committing code) that could be abused as a backdoor or for remote control of repos and secrets.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly clones and interacts with external repositories and GitHub MCP servers (see the "clone" section and mcp_servers/github entries in SKILL.md and references/agent-examples.md), so the agent will fetch and interpret untrusted, user-generated repo/PR content which can directly change tool use and subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The agent spec includes a required runtime container image that will be pulled and executed from pkg.harness.io/vrvdt5ius7uwygso8s0bia/harness-agents/claude-code-plugin:main, meaning remote code is fetched and run at runtime, so this external URL is a high-confidence runtime dependency that executes code.