Harvest Time Reporting

• Analyzed: May 12, 2026, 3:17 AM
• Findings: 1
• Version: 1.0.0
• Hash: b35cf81196dfde025ab44c3b690741ea6dc1f90ace990d77f66f21e76ce07be8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive API reference for Harvest time tracking, using standard `curl` commands to interact with the legitimate `https://api.harvestapp.com/v2` endpoint. It correctly uses environment variables (`HARVEST_ACCESS_TOKEN`, `HARVEST_ACCOUNT_ID`) for authentication. There is no evidence of prompt injection against the agent, malicious execution, data exfiltration to unauthorized destinations, persistence mechanisms, or obfuscation in `skill.md` or `_meta.json`.