harnass-engineer-plan
Warn
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The SKILL.md and research-and-plan.yaml files include 'CRITICAL EXECUTION RULES' that explicitly command the agent to ignore standard turn-taking protocols. The instructions 'Do NOT ask "should I proceed?"' and 'Do NOT wait' after a plan is approved are designed to bypass human-in-the-loop safety checkpoints for all subsequent implementation tasks.
- [COMMAND_EXECUTION]: The skill frequently invokes the Bash tool to perform repository scanning and project management. Notable commands include 'ripgrep' (rg) for searching directory contents and 'python -c' for extracting scripts from package.json and checking for the presence of lock files. It also uses git commands for worktree and branch management during the implementation phase.
- [REMOTE_CODE_EXECUTION]: The 'begin-implementation' step in research-and-plan.yaml defines a flow where the agent executes arbitrary shell commands found in 'task.implementation_steps' and 'task.validation_commands' without further user verification. This allows for the automated execution of generated or repository-derived code sequences.
- [EXTERNAL_DOWNLOADS]: The 'web-search-market-stacks' step utilizes the WebSearch tool to fetch external data regarding framework readiness and best practices. While used for research, this process introduces unverified external content into the agent's decision-making context.
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect injection by ingesting data from untrusted local files like 'package.json', 'wrangler.toml', and '.env.example'.
- Ingestion points: repository configuration files and source code directories are scanned via ripgrep.
- Boundary markers: The skill does not implement delimiters or 'ignore' instructions when processing external repository data.
- Capability inventory: The agent possesses 'Bash', 'Write', and 'WebSearch' capabilities.
- Sanitization: No explicit sanitization or validation of the data extracted from the repository is performed before it is used to construct implementation tasks.
Audit Metadata