harvest
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill interacts exclusively with the official Harvest API (api.harvestapp.com) and Zapier-managed authentication services. No evidence of unauthorized data access or exfiltration was found.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (e.g., time entry notes). It implements strict schema validation using the Zod library for all tool inputs, which mitigates the risk of indirect injection. All tools include boundary markers and clear capability descriptions.- [REMOTE_CODE_EXECUTION]: The skill includes a CLI entry point (cli.js) that manages runtime environment checks and delegates execution to the connector scripts. This is standard boilerplate functionality and does not perform unauthorized remote code execution.- [OBFUSCATION]: No obfuscated code, hidden URLs, or suspicious encoding patterns were detected in the source files.
Audit Metadata