xmake-harness

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the harness addon directly from a GitHub repository associated with the xmake ecosystem (e.g., xmake addon --install github:xmake-addons/xmake-harness).
  • [COMMAND_EXECUTION]: The documentation describes running a terminal agent (xmake ai) that is capable of executing build commands, running unit tests, and modifying project files. It also highlights a bypass mode that allows the agent to execute commands without manual user confirmation.
  • [INDIRECT_PROMPT_INJECTION]: As a tool designed to analyze and build software projects, the agent described in this skill processes untrusted external data (project source code), which represents a potential attack surface for indirect prompt injection if the source code contains malicious instructions.
  • Ingestion points: Reads the project directory where it is executed (SKILL.md).
  • Boundary markers: None explicitly documented in the instructions.
  • Capability inventory: File system edits, shell command execution, and build system interaction via xmake.
  • Sanitization: Not detailed in the user-facing installation instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 09:52 AM
Security Audit — agent-trust-hub — xmake-harness