long-running-harness

This skill appears to do what it says (manage long-running project tasks) but it will run shell commands and project-provided init.sh scripts that can install packages, start services, and execute arbitrary code. Things to consider before installing or using it: - Only run this on repositories/projects you trust. Review any init.sh, init_db.sh, package.json, requirements.txt, and test scripts before allowing the agent to execute them. - The skill assumes tools (git, bash, curl, npm, pip, python, pytest) are available but the metadata doesn't declare them — ensure your environment provides these or update the skill metadata to reflect requirements. - The agent will perform git commits; ensure your git credentials and remote configuration are what you expect, and don't let it commit secrets or credentials into repos. - If you need strong containment, run the harness in an isolated/sandboxed environment (container/VM) or deny network access so package installs cannot fetch remote code. - Be cautious with cron job scheduling — the skill includes an example for periodic checks; only enable scheduled runs when you have control over what the agent will execute autonomously. If you want to reduce risk: require explicit user confirmation before running any init.sh or performing installs, restrict which project paths the skill can act on, and add explicit declarations of required binaries and any expected external credentials.