skills.rest
MaiconGambini
MaiconGambiniCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

harness-security-scan

Scan harness skills, agents, plugins, and configs for secrets and injection patterns.

Updated Jul 29, 2026
Search Tags:#security scan#secret detection#opencode#prompt injection#supply chain#mcp config#shell patterns
One-click install
npx skills add https://github.com/MaiconGambini/opencode-harness-guide --skill harness-security-scan-maicongambini
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: harness-security-scan
Source: https://github.com/MaiconGambini/opencode-harness-guide/tree/main/skills/harness-security-scan
Command: npx skills add https://github.com/MaiconGambini/opencode-harness-guide --skill harness-security-scan-maicongambini

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Agent harness configurations accumulate supply-chain risks: leaked secrets in configs, hidden Unicode characters, prompt-injection HTML comments, and dangerous shell commands embedded in skills, plugins, and MCP configs. This Skill runs a deterministic scanner that surfaces these findings without exposing secret values. ## Core Features & Use Cases - Secret Detection: Flags inline secrets across skills, agents, plugins, MCP configs, scripts, and goal memory, reporting only file and key locations. - Injection and Unicode Warnings: Detects hidden Unicode characters and prompt-injection HTML comments in harness surfaces. - Dangerous Command Detection: Warns on risky shell and network commands found in scripts and configs. - Use Case: Before merging a community-contributed OpenCode plugin, run the scan from the repository root to confirm it contains no embedded credentials or injection payloads, then convert any CRITICAL findings into a remediation plan. ## Quick Start Run the harness security scan from the repository root and report any secrets, injection patterns, or dangerous commands found in my skills and configs.

Frequently Asked Questions about harness-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan OpenCode harness configs for leaked secrets?▼

Run node .opencode/scripts/harness-security-scan.mjs from the repository root. The scanner checks skills, agents, plugins, MCP configs, scripts, and goal memory, reporting only file and key locations so secret values are never printed.

What security issues does a harness security scan detect?▼

The scan warns on inline secrets, hidden Unicode characters, prompt-injection HTML comments, and dangerous shell or network commands. It treats skills, agents, plugins, MCP configs, scripts, and goal memory as supply-chain surfaces.

Does the security scan print the actual secret values it finds?▼

No. The scan never prints secret values; it reports only the file and key locations where secrets were detected. This prevents accidental credential exposure in logs or terminal output.

What should I do with CRITICAL findings from the scan?▼

Convert CRITICAL findings into a remediation plan before editing any files. This ensures each finding is triaged and addressed systematically rather than patched ad hoc.

Can the scan detect prompt injection in skill files?▼

Yes. The scanner warns on prompt-injection HTML comments and hidden Unicode characters embedded in harness surfaces such as skills and agents, which are common vectors for manipulating agent behavior.

Related Skills

Explore More Software Engineering Skills→
contentbugvideoeditingcontentbugvideoediting

workspace-surface-audit

Audit workspace surfaces and benchmark against official ECC-native capabilities.

Community
Intermediate
Trigent-Software-Pvt-LtdTrigent-Software-Pvt-Ltd

secrets

Detect exposed secrets, credentials, and API keys in code and git history.

Official
Advanced
helderbertohelderberto
12

deps-audit

Audit npm dependencies for vulnerabilities and outdated packages.

Community
Intermediate
OWASPOWASP
141

secrets-scan

Detect hardcoded secrets in source code and configuration files.

Official
Intermediate