harness-master
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes a local Python script (
scripts/discover_surfaces.py) to identify and map configuration files across project and global environments. - [EXTERNAL_DOWNLOADS]: Retrieves current configuration guidance from well-known, authoritative documentation sources including code.claude.com, cursor.com, and developers.openai.com.
- [DATA_EXFILTRATION]: Accesses global configuration surfaces (e.g., in
~/.claude/or~/.cursor/) to provide cross-environment audits. While this involves reading data outside the repository, it is central to the skill's stated purpose and is performed within a dry-run-first framework. - [PROMPT_INJECTION]: The skill acts on untrusted repository content (like
README.mdandAGENTS.md) which presents an indirect prompt injection surface. This risk is mitigated by the skill's design, which requires a manual review of findings and explicit user consent before any remediation actions are taken.
Audit Metadata