Skills/ClawHub/agent-harness-engineer

agent-harness-engineer@1.0.0

CAUTION· static only

Publisher claims: "指导AI coding工具构建生产级Agent系统。当用户需要设计、实现或优化AI Agent系统时触发。 特别适用于：Agent架构设计、Harness工程、工具系统、权限模型、上下文管理、多智能体协作、 记忆系统、安全沙箱、MCP集成等场景。支持从概念设计到生产部署的完整Agent系统构建。 触发关键词：构建..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher sofild · publishing for 152 daysInstalls 552Last detonated 29 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-13 and scored it 51/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathsevals/evals.json:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…les": ["README.md", "pyproject.toml", "docker-compose.yaml", "prometheus.yml", ".env.example", "config/settings.yaml", "config/settings.production.yaml", "config/ag…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsevals/evals.json:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…户未明确规模，主动建议Professional并说明理由", "files": ["README.md", "pyproject.toml", ".env.example", "config/settings.yaml", "src/main.py", "src/agent/core.py", "src/agen…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsevals/evals.json:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"files": ["src/main.py", "src/agent.py", ".env.example", "README.md"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathstemplates/minimal/python/src/main.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# TODO: 加载 .env 文件中的环境变量Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandtemplates/project-scaffold/nodejs/config/settings.yaml:35 · Privileged sudo command — agent may execute with elevated privileges- pattern: "Bash(sudo *)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsSKILL.md:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files│ 配置管理 │ .env 文件 │ YAML + pydantic/zod │ 7级层级化配置覆盖 │Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsevals/evals.json:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…hase 1-7完整实现，包含四级压缩管道和完整权限模型", "files": ["README.md", "pyproject.toml", ".env.example", "config/settings.yaml", "src/main.py", "src/agent/core.py", "src/agen…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsevals/evals.json:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"files": ["src/main.py", "src/agent.py", ".env.example", "README.md"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Persistence: instructs the agent to auto-load this skill in future sessionsREADME.md:36 · Persistence: instructs the agent to auto-load this skill in future sessions · informational: not an instruction fileThe AI will automatically load this Skill and guide you through a structured 7-phase build process — from scaffolding to production deployment.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Destructive file system command detectedtemplates/project-scaffold/nodejs/tests/test_permissions.js:58 · Destructive file system command detectedconst result = manager.validateCommand('rm -rf /');Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstemplates/project-scaffold/python/tests/test_permissions.py:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert manager.validate_path("workspace/.env") == FalseFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionevals/evals.json:225 · File type combined with upload action — agent may exfiltrate local data files…ut": "在Phase 6中实现完整的6层纵深防御架构：Layer 6-Hardcoded Denies（编译期/启动期注入的不可变拒绝清单，settings.json/.claude/skills写保护）、Layer 5-Audit Logging（Session WAL即审计日志，全量记录不可删除）、Layer 4-Sandbox（文件系统隔离+网络隔离+进程隔离）、Layer 3-Hook System（26个事件×4种类型：PreToolUse/PostToolU…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Destructive file system command detectedtemplates/project-scaffold/python/tests/test_permissions.py:33 · Destructive file system command detectedresult = manager.check_permission("Bash(rm -rf /)", {})Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathstemplates/project-scaffold/python/config/settings.yaml:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- ".env.*"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiontemplates/project-scaffold/nodejs/config/hooks/pre-tool-use.js:13 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`[Hook] Input:`, toolInput);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathstemplates/project-scaffold/nodejs/config/settings.yaml:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Privileged sudo commandtemplates/project-scaffold/python/tests/test_permissions.py:47 · Privileged sudo command — agent may execute with elevated privilegesmanager.check_permission("Bash(sudo ls)", {})Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Destructive command against a filesystem root or devicetemplates/project-scaffold/python/tests/test_permissions.py:79 · Destructive command against a filesystem root or deviceassert manager.validate_command("rm -rf /") == FalseFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiontemplates/project-scaffold/nodejs/config/hooks/post-tool-use.js:12 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`[Hook] Post-tool-use: ${toolName}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathstemplates/project-scaffold/nodejs/config/settings.yaml:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- ".env.*"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive command against a filesystem root or devicetemplates/project-scaffold/nodejs/tests/test_permissions.js:58 · Destructive command against a filesystem root or deviceconst result = manager.validateCommand('rm -rf /');Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiontemplates/project-scaffold/nodejs/config/hooks/post-tool-use.js:13 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`[Hook] Output length:`, toolOutput.length);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Privileged sudo commandtemplates/project-scaffold/python/tests/test_permissions.py:41 · Privileged sudo command — agent may execute with elevated privileges{"pattern": "Bash(sudo *)", "action": "ask"}Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstemplates/project-scaffold/nodejs/tests/test_permissions.js:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst result = manager.validatePath('workspace/.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtemplates/project-scaffold/nodejs/tests/test_permissions.js:21 · Destructive file system command detectedconst result = manager.checkPermission('Bash(rm -rf /)', {});Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstemplates/project-scaffold/python/tests/test_permissions.py:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"denied_patterns": [".env"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtemplates/project-scaffold/python/tests/test_permissions.py:79 · Destructive file system command detectedassert manager.validate_command("rm -rf /") == FalseFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathstemplates/project-scaffold/python/config/settings.yaml:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstemplates/project-scaffold/nodejs/tests/test_permissions.js:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdeniedPatterns: ['.env']Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtemplates/project-scaffold/nodejs/tests/test_permissions.js:15 · Destructive file system command detected{ pattern: 'Bash\\(rm -rf \\*\\)', action: 'deny' }Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandtemplates/project-scaffold/python/config/settings.yaml:35 · Privileged sudo command — agent may execute with elevated privileges- pattern: "Bash(sudo *)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈2,942 tok
1 file · 123 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

29 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim sofild: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Destructive file system command detected≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  5. File type combined with upload action≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  6. Destructive command against a filesystem root or device≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim sofildPropose a patch to the maintainer