Security audit
Harness Design Patterns
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a documentation-only design guide, but it includes under-scoped guidance to run agent workflows with permission checks bypassed and hooks that read session data.
Installing this skill should not run code by itself. Before following its examples, avoid permission-bypass mode unless you are in an isolated test environment, review any hook scripts before enabling them, restrict access to transcript and shared-memory directories, and add cleanup and file-permission controls for generated session state.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.