Research Harness

Summary of what to check before installing: - Understand the workspace I/O: This skill expects the agent to read and write files like .task-pulse, .checkpoint/, coverage/, active-tasks.md, biases.md, and to archive outputs. If your workspace contains sensitive files, the harness could read them — run it in a dedicated / disposable workspace first. - Review INSTALL-PROMPT.md before copy-pasting: The manifest includes a 'critical' install prompt that the author expects you to paste into your agent's system prompt to force behavior. That is a persistent change to your agent configuration; inspect it and only apply it if you trust the author and understand the effects. - Optional connectors need credentials: iFind MCP and other adapters are optional but require external credentials if enabled. Only provide those to trusted code and verify what the skill will do with those sources. - Test with limited permissions: If possible, enable the skill in a restricted environment (no network credentials, separate workspace) to observe what files it creates and how it autotrigger behaves. - Audit created files: After first use, inspect .task-pulse, .checkpoint, and coverage/ outputs to confirm they contain only expected research artifacts and no leakage of other local data. - Disable/modify auto-trigger behavior if undesired: The harness defines many trigger rules that cause the menu and routing to display automatically on common phrases. If you find that intrusive, do not apply the INSTALL-PROMPT and avoid wiring it into your global system prompt — instead invoke the skill manually. What would change this assessment: evidence that the skill's INSTALL-PROMPT is benign and only contains non-persistent helper text, or explicit metadata declaring the config paths and a clear permission model for file I/O; conversely, discovery of hidden remote-download/install steps or commands that access system-level paths would raise the risk to 'malicious'.