Agent Tool Risk
Use this skill for MCP, plugins, hooks, sub-agents, tool permissions, prompt flows, automation loops, and model-visible logs.
Workflow
- Inventory the agent/tool surface: trigger, command, permissions, inputs, outputs, and persistence.
- Classify risk:
- prompt injection or untrusted content
- excessive agency or destructive authority
- secret exposure
- data exfiltration through logs or MCP
- command injection
- stale or misleading model-visible memory
- Confirm high-risk operations have human approval or guard hooks.
- Ensure hidden logs are not loaded as default model context.
- Ensure model-visible logs contain only durable, necessary retry context.
- Update
docs/harness/AGENT_SECURITY.md, docs/harness/SECURITY_POLICY.md, and docs/harness/SUBAGENT_PROTOCOL.md if behavior changes.
Required Output
Return tool surface, risk class, mitigations, required approvals, logging impact, and remaining risks.
Blockers
- Secrets written to repo, hidden logs, or model-visible memory.
- Mutating cloud or git actions without explicit approval.
- Hooks that execute untrusted user content as shell commands.
- MCP credentials committed or printed.
1---2name: agent-tool-risk3description: Agent and tool security review workflow. Use when adding or changing MCP servers, Codex plugins, hooks, sub-agents, tool permissions, prompt flows, automation loops, or model-visible logs.4---56# Agent Tool Risk78Use this skill for MCP, plugins, hooks, sub-agents, tool permissions, prompt flows, automation loops, and model-visible logs.910## Workflow11121. Inventory the agent/tool surface: trigger, command, permissions, inputs, outputs, and persistence.132. Classify risk:14 - prompt injection or untrusted content15 - excessive agency or destructive authority16 - secret exposure17 - data exfiltration through logs or MCP18 - command injection19 - stale or misleading model-visible memory203. Confirm high-risk operations have human approval or guard hooks.214. Ensure hidden logs are not loaded as default model context.225. Ensure model-visible logs contain only durable, necessary retry context.236. Update `docs/harness/AGENT_SECURITY.md`, `docs/harness/SECURITY_POLICY.md`, and `docs/harness/SUBAGENT_PROTOCOL.md` if behavior changes.2425## Required Output2627Return tool surface, risk class, mitigations, required approvals, logging impact, and remaining risks.2829## Blockers3031- Secrets written to repo, hidden logs, or model-visible memory.32- Mutating cloud or git actions without explicit approval.33- Hooks that execute untrusted user content as shell commands.34- MCP credentials committed or printed.
jh941213