The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/update_runtime.py script is designed to fetch a runtime manifest and individual script files from a remote GitHub repository (https://raw.githubusercontent.com/xmzDesign/santong-skill/). While this is a declared feature for maintaining the harness runtime, it involves downloading executable content from the internet.
[REMOTE_CODE_EXECUTION]: The update mechanism in scripts/update_runtime.py downloads Python and Shell scripts and overwrites local files within the .harness/scripts/ directory. These scripts (such as qa_runner.py and init.sh) are subsequently executed by the agent to perform workflow tasks, creating a vector for remote code execution if the source repository were compromised.
[COMMAND_EXECUTION]: Several scripts utilize the subprocess module to execute system-level commands.
scripts/qa_runner.py runs mvn test and mvn verify, which can execute arbitrary code defined in a project's build configuration.
scripts/testcontainers_doctor.py executes docker info to check the environment.
scripts/scaffold.py and scripts/update_runtime.py use chmod to grant execution permissions to generated or updated scripts.
templates/harness/hooks/context-injector.py and other hook scripts run Git commands and additional Python processes.

by-harness