Security audit
Lean Claude Code Harness
Security checks for vulnerabilities and agentic risk
Overview
This is an instruction-only guidance skill for designing auditable coding-agent harnesses, with no scripts, installs, credentials, or hidden data access.
Installers should treat this as a best-practices guide, not an automated tool. If they use its recommendations to build a harness, they should still review any generated code and be deliberate about transcript storage because transcripts may contain sensitive user or project data.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.