harness-master

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes a local Python script (scripts/discover_surfaces.py) to identify and map configuration files across project and global environments.
  • [EXTERNAL_DOWNLOADS]: Retrieves current configuration guidance from well-known, authoritative documentation sources including code.claude.com, cursor.com, and developers.openai.com.
  • [DATA_EXFILTRATION]: Accesses global configuration surfaces (e.g., in ~/.claude/ or ~/.cursor/) to provide cross-environment audits. While this involves reading data outside the repository, it is central to the skill's stated purpose and is performed within a dry-run-first framework.
  • [PROMPT_INJECTION]: The skill acts on untrusted repository content (like README.md and AGENTS.md) which presents an indirect prompt injection surface. This risk is mitigated by the skill's design, which requires a manual review of findings and explicit user consent before any remediation actions are taken.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 01:33 PM
Security Audit — agent-trust-hub — harness-master