xmake-harness
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the harness addon directly from a GitHub repository associated with the xmake ecosystem (e.g.,
xmake addon --install github:xmake-addons/xmake-harness). - [COMMAND_EXECUTION]: The documentation describes running a terminal agent (
xmake ai) that is capable of executing build commands, running unit tests, and modifying project files. It also highlights abypassmode that allows the agent to execute commands without manual user confirmation. - [INDIRECT_PROMPT_INJECTION]: As a tool designed to analyze and build software projects, the agent described in this skill processes untrusted external data (project source code), which represents a potential attack surface for indirect prompt injection if the source code contains malicious instructions.
- Ingestion points: Reads the project directory where it is executed (SKILL.md).
- Boundary markers: None explicitly documented in the instructions.
- Capability inventory: File system edits, shell command execution, and build system interaction via
xmake. - Sanitization: Not detailed in the user-facing installation instructions.
Audit Metadata