AI Harness Engineering

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 1.0.0

Overview

This skill is an error-learning notebook, but it can automatically persist conversation-derived content and later write it into files that shape future agent behavior.

Install only if you want an always-on, persistent error-learning system. Before enabling it, require explicit confirmation before recording or promoting entries, disable or review the auto-promotion cron task, inspect any proposed changes to SOUL.md/AGENTS.md/TOOLS.md/MEMORY.md, and avoid recording secrets or private conversation content because redaction is not enforced.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/promote.py:91

Finding

Untrusted Conversation Content Is Persisted into Agent Control Files

Content

View full analysis

dict: """将学习提升到workspace文件""" workspace = Path.home() / ".qclaw" / "workspace" # 目标文件路径 target_path = workspace / target_file # 加载学习内容 learnings = load_learnings() learning = None for l in learnings: if l.get('learning_id') == learning_id: learning = l break if not learning: return {"status": "error", "message": f"未找到学习记录 {learning_id}"} # 如果是 dry_run，直接返回模拟结果 if dry_run: return { "status": "ok", "message": f"模拟提升 {learning_id} 到 {target_file}", "target": str(target_path), "dry_run": True } # 蒸馏为简洁规则 summary ...[truncated 3282 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/promote.py:65

Finding

User Feedback Bypasses the Recurrence Threshold and Is Automatically Promoted

Content

View full analysis

= 3 if learning.get('recurrence_count', 1) >= 3: should_promote = True target = "AGENTS.md" # 重复多次应该提升到工作流程 # 条件2: 高优先级 elif learning.get('priority') in ['high', 'critical']: should_promote = True target = "SOUL.md" if learning.get('category') == 'correction' else "AGENTS.md" # 条件3: 用户明确要求 if learning.get('source') == 'user_feedback': should_promote = True target = "MEMORY.md" if should_promote and learning.get('status') == 'pending': learning['suggested_target'] = target candidates.append(learning) ``` `scripts/promote.py:199-233`: ```python elif args.action == 'auto_promote': # 自动提升：检查所有 recurrence_count >= 3 的学习 candidates = check_promote_candidates() if not candidates: print(json.dumps({ "status": "ok", "message": "暂无可自动提升的学习", "promoted_count": 0 }, ensure_ascii=False, indent=2)) return # 自动提升每个候选 promoted = [] for candidate in candidates: learning_id = candidate.get('learning_id') suggested_target = candidate.get('suggested_target', 'AGENTS.md') if args.dry_run: promoted.append({ "learning_id": learning_id, "target": suggested_target, "dry_run": True }) else: result = promote_to_workspace(learning_id, suggested_target) if result.get('status') == 'ok': promoted.append({ "learning_id": learning_id, "target": suggested_target }) ``` `scripts/record_learning.py:152-154`: ```python parser.add_argument('--source ...[truncated 1918 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:27

Finding

Scheduled Automatic Promotion Creates Unattended Cross-Session Persistence

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/record_error.py:141

Finding

Sensitive Conversation Content Is Stored in Plaintext Without Enforced Redaction

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The Chinese-language description similarly overstates automated recording, trigger handling, and evolution capabilities relative to the referenced behavior. Misrepresentation of automation and scope increases the chance of unsafe deployment and weakens administrator ability to assess risk correctly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The Chinese-language description similarly overstates automated recording, trigger handling, and evolution capabilities relative to the referenced behavior. Misrepresentation of automation and scope increases the chance of unsafe deployment and weakens administrator ability to assess risk correctly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The Chinese-language description similarly overstates automated recording, trigger handling, and evolution capabilities relative to the referenced behavior. Misrepresentation of automation and scope increases the chance of unsafe deployment and weakens administrator ability to assess risk correctly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The Chinese-language description similarly overstates automated recording, trigger handling, and evolution capabilities relative to the referenced behavior. Misrepresentation of automation and scope increases the chance of unsafe deployment and weakens administrator ability to assess risk correctly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The Chinese-language description similarly overstates automated recording, trigger handling, and evolution capabilities relative to the referenced behavior. Misrepresentation of automation and scope increases the chance of unsafe deployment and weakens administrator ability to assess risk correctly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The Chinese-language description similarly overstates automated recording, trigger handling, and evolution capabilities relative to the referenced behavior. Misrepresentation of automation and scope increases the chance of unsafe deployment and weakens administrator ability to assess risk correctly.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The Chinese-language description similarly overstates automated recording, trigger handling, and evolution capabilities relative to the referenced behavior. Misrepresentation of automation and scope increases the chance of unsafe deployment and weakens administrator ability to assess risk correctly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill explicitly creates persistent data files under the user's home skill directory for error, feature, and learning ledgers, and the skill's purpose is to continuously record and reuse conversational content. In this context, session persistence is security-relevant because sensitive user data, internal prompts, or injected content may survive across sessions and later influence model behavior through automated review and summary injection.

Content

Scanner excerpt · PACKAGE.md (reported line 32)May include surrounding context.

md

cp -r harness-engineering/ ~/.qclaw/skills/

# 2. 创建数据目录
mkdir -p ~/.qclaw/skills/harness-engineering/data/

# 3. 创建空数据文件
touch ~/.qclaw/skills/harness-engineering/data/error_ledger.jsonl

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The package documents commands that persist user-provided questions, wrong answers, correct answers, reasons, and learning details into on-disk ledger files, and it also describes automatic later processing through review, promotion, pre-answer checks, and session-start summary injection. Because the documentation does not warn users that potentially sensitive or adversarial content will be stored and re-consumed automatically, it creates a privacy and prompt-injection risk surface that operators may not understand.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents file read/write behavior and scheduled script execution but does not declare any explicit tool scope or permissions. That creates an unsafe trust boundary: a consumer may authorize broader filesystem access than expected, and reviewers cannot easily verify or constrain what files the skill may touch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest description is written as a Chinese-only behavioral description for the skill, while the document does not state that language is optional or user-selectable. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Very broad trigger phrases for feature requests can activate on ordinary conversation, causing unintended recording or workflow execution. In a persistent skill, over-triggering can silently accumulate user content and create inaccurate or privacy-sensitive records without clear consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatically promoting stored 'learnings' into SOUL.md, AGENTS.md, TOOLS.md, and MEMORY.md means the skill can modify durable governance and behavior-shaping files, not just maintain an error log. Because those files influence future agent operation, malformed or adversarially seeded content can persistently steer behavior across tasks.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Session-start summary injection takes previously stored content and places it into future model context, creating a built-in cross-session data leakage path. If stored records contain user-specific facts, confidential prompts, or poisoned instructions, they may be exposed or influence unrelated future conversations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The ledger schemas explicitly persist raw user questions, correct answers, details, and user context across time. This long-term collection increases the blast radius of any accidental sensitive-data capture and creates a durable repository of conversation-derived content that may later be queried or reused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Automatic recording on generic correction phrases is ambiguously scoped and may capture large portions of conversation or third-party content whenever a user says something is wrong. Because the ledger is persistent and later reused, accidental capture can become a long-term privacy and integrity problem.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The answer-time self-check explicitly instructs reuse of past records and 'correct answers' in new responses, which can re-expose stored content from prior interactions. This creates both privacy risk and prompt-injection risk, because poisoned or confidential historical entries can shape later outputs in unrelated contexts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill is designed for session persistence by creating data files under the user's home directory, which is not inherently malicious but does create durable storage of conversation-derived records. In this skill's context, persistence amplifies the privacy and cross-session influence risks because stored entries are later reused for summaries, self-checks, and promotion.

Content

Scanner excerpt · SKILL.md (reported line 646)May include surrounding context.

md

cp -r harness-engineering/ ~/.qclaw/skills/

# 2. 创建数据目录
mkdir -p ~/.qclaw/skills/harness-engineering/data/

# 3. 创建空数据文件
touch ~/.qclaw/skills/harness-engineering/data/error_ledger.jsonl

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill says sensitive information should not be recorded, yet the documented commands store raw questions, wrong answers, correct answers, reasons, and detailed context. In practice this creates a high chance of collecting secrets, personal data, or confidential prompts unless sanitization is enforced before persistence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This manifest-style JSON uses Chinese values for key user-facing taxonomy fields such as error type, severity, fix status, and tags. If consumed by a broader skill or agent system, it imposes a single locale without indicating user opt-in or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains natural-language guidance exclusively in Chinese, starting from the title and throughout the document. Under the policy rule for language/locale, forcing a specific language without user opt-in or a documented justification is a violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/error_patterns.md (reported line 262)May include surrounding context.

response = requests.post(url, data={'key': 'value'}) # 可能是 form data

正确：根据 API 要求选择

response = requests.post(url, json={'key': 'value'}) # JSON 格式

text

---

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module docstring is entirely in Chinese and describes automatic session-start behavior for injecting summaries, which indicates a language-specific operating assumption. There is no accompanying text offering a language/locale choice or explaining that this skill is intentionally limited to a Chinese-language environment.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code automatically loads prior ledger entries and injects them into session context/output, including slices of user questions and correct answers. That creates a cross-session data leakage channel: sensitive or private content recorded in the ledger can be surfaced to later sessions or users without authorization, and injected text can also steer model behavior in unintended ways because it is treated as trusted context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code contains natural-language descriptions and output intended for users entirely in Chinese, such as the module docstring and CLI help text, but does not provide any opt-in or alternative language. Under the language/locale policy, forcing a specific language without user choice is a policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.