Harness Factory — AI Engineering Team

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:05 AM UTC
• Version: 0.7.0

Overview

The skill has a coherent engineering workflow, but it delegates repository work to Claude agents and includes commit, push, deploy, and broad auto-trigger instructions without enough approval boundaries.

Install only if you are comfortable with Claude/ACP agents reading and modifying your repository. Before use, require explicit approval for each external-agent launch, commit, push, deploy, and production check; avoid adding the broad AGENTS.md auto-trigger unless you really want persistent activation; replace git add -A with reviewed file staging and prefer project-pinned build commands over bare npx.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:18

Finding

Skill instruction hijacking through explicit Agent role reassignment

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:310

Finding

Persistent Agent configuration poisoning through automatic Skill activation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:216

Finding

Unapproved repository publication and production deployment workflow

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Shell injection exposure in unquoted command templates

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: ` - TypeScript: `npx tsc --noEmit` - Lint: `grep -rn "console.log\|TODO\|FIXME\|HACK" <changed_files>` ``` ### Technical Analysis The Builder is instructed to run `npx tsc --noEmit` without verifying that the expected compiler is installed locally and pinned by the project lockfile. Depending on the installed npm/npx version and environment configuration, `npx` may resolve and download a package when a matching local executable is unavailable. The command does not identify a package version, requir ...[truncated 1384 chars]:16

Finding

Unpinned third-party package execution through npx

Content

View full analysis

` - TypeScript: `npx tsc --noEmit` - Lint: `grep -rn "console.log\|TODO\|FIXME\|HACK" ` ``` ### Technical Analysis The Builder is instructed to run `npx tsc --noEmit` without verifying that the expected compiler is installed locally and pinned by the project lockfile. Depending on the installed npm/npx version and environment configuration, `npx` may resolve and download a package when a matching local executable is unavailable. The command does not identify a package version, require lockfile resolution, enforce offline operation, or fail when the expected local binary is missing. Consequently, the code executed during a supposed mechanical check may be determined by mutable external package resolution rather than the audited project dependencies. ### Attack Path 1. The Builder enters a project where the expected local TypeScript compiler executable is absent or cannot be resolved. 2. The Builder runs `npx tsc --noEmit` as required by the agent instructions. 3. `npx` attempts to resolve or retrieve a package providing the requested command. 4. Retrieved third-party code executes under the Builder’s operating-system account. 5. Malicious or compromised package code accesses the workspace, environment variables, credentials, or network resources available to that process. ### Impact Assessment A compromised dependency can execute code with the same privileges as the Builder. The accessible scope may include the full source tree, writable worktrees, Git credentials, package registry credentials, environment variables, SSH configuration, and network services reachable from the development environment. No malicious package is embedded in this project, b ...[truncated 81 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The skill explicitly selects an external model/tool (claude --agent=builder) to read project files and implement changes. This can send sensitive source code or repository context to an external provider without a strong warning, consent step, or data-handling boundary, creating confidentiality and supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

git worktree add ../[project]-build feature/[feature-name]

Run Builder with agent template

claude --agent=builder -w ../[project]-build --bare -p "Read SPRINT.md and implement all success criteria. Write BUILDER_REPORT.md when done."

text

The `builder` agent template (in `agents/builder.md`) provides:

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

This instruction launches an external builder agent for a sub-sprint, which may expose repository contents to a third-party model or service. Because it is framed as standard workflow guidance, users may not realize code is being delegated outside the current trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

git worktree add ../build-tests sprint/tests

# Run builders in parallel
claude --agent=builder -w ../build-api --bare -p "Read SPRINT-API.md..." &
claude --agent=builder -w ../build-frontend --bare -p "Read SPRINT-FRONTEND.md..." &
claude --agent=builder -w ../build-tests --bare -p "Read SPRINT-TESTS.md..." &
wait

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

This line repeats the pattern of delegating project work to an external builder agent, now for frontend changes. Frontend code can still contain credentials, internal endpoints, business logic, or unpublished features, so silent provider selection remains a security concern.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

Run builders in parallel

claude --agent=builder -w ../build-api --bare -p "Read SPRINT-API.md..." & claude --agent=builder -w ../build-frontend --bare -p "Read SPRINT-FRONTEND.md..." & claude --agent=builder -w ../build-tests --bare -p "Read SPRINT-TESTS.md..." & wait

text

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

This instruction spawns another external builder agent instance, multiplying the amount of code and context potentially disclosed to outside tooling. Parallelization increases operational convenience, but also broadens exposure and makes oversight harder if no consent or policy checks are in place.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

Run builders in parallel

claude --agent=builder -w ../build-api --bare -p "Read SPRINT-API.md..." & claude --agent=builder -w ../build-frontend --bare -p "Read SPRINT-FRONTEND.md..." & claude --agent=builder -w ../build-tests --bare -p "Read SPRINT-TESTS.md..." & wait

text

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The reviewer path also mandates use of an external claude agent to inspect changed files, which can expose code and change history to a third party. Even read-only review can leak sensitive implementation details, so this should not be treated as risk-free automation.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

bash

# Use the reviewer agent template — it sees only the code, not the Builder's reasoning
claude --agent=reviewer -w ../[project]-build --bare -p "Read SPRINT.md and review all changed files. Write REVIEWER_REPORT.md."

Option B: ACP Session

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to perform repository and operational actions beyond code generation, including git commit, git push, deployment, and production verification. Those steps can create immediate external side effects and move unreviewed or incorrect changes into shared or production environments, which is risky for a generally invocable engineering workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs committing, pushing, and potentially deploying as part of the normal success path, but does not warn the user that these actions mutate repositories or may impact production. Lack of explicit disclosure and consent increases the chance of surprising, irreversible, or policy-violating actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Including deployment and production verification in a reusable engineering harness expands the skill from development assistance into operational control. If invoked in the wrong context, the skill could trigger deployment-related actions that affect live systems without a separate authorization boundary.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.

markdown

### 🏭 Harness Engineering
When task involves: new feature, complex bug fix, refactoring, multi-file changes
→ Read `~/.openclaw/skills/harness-engineering/SKILL.md` and follow the 5-phase workflow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill instructs the agent to run npx tsc --noEmit without pinning the package/version, which can cause npx to resolve and execute a package from the registry if TypeScript is not already installed locally. In an agentic build workflow, this creates a supply-chain execution risk because unpinned remote code may run during routine checks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The checklist item mandates grepping for Chinese characters before shipping in an English app, which encodes a language-based exclusion rule without clear user-consent, accessibility, localization, or compliance justification. In an engineering harness, checklist items are likely to be operationalized and enforced, so this can lead to discriminatory filtering of legitimate content, suppression of multilingual support, and biased review behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The workflow repeatedly instructs use of Claude Code and ACP sessions with agentId: "claude", making a specific provider/agent mandatory in the natural-language instructions. This imposes a tool/vendor constraint without user opt-in or documented justification, which can be treated as a policy-style natural-language constraint issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.