Cursor, Plugin
Harness Score
Your AI coding agent is only as reliable as the harness around it.
Compatibility: Portable across standard formats.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit b8c3941ba49e.
INSTALL_LIFECYCLE_HOOK
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 29
prepare
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
packages/cli/bench/scan.bench.mjs, line 108
fs.rmSync(root, { recursive: true, force: true });
Install and update
Concern
runs a script at install time.
INSTALL_LIFECYCLE_HOOK
package.json, line 29
prepare
Network
Note
can reach github.com.
NETWORK_NAMED_HOST
.github/workflows/release.yml, line 68
const response = await fetch('https://github.com/marketplace/actions/harness-score');
.github/workflows/release.yml, line 214
node -e "fetch('https://jsr.io/@paladini/harness-score/meta.json').then(r=>{if(!r.ok)throw Error(r.status);return r.json()}).then(j=>{if(!j.versions?.[process.env.RELEASE_VERSION])
.github/workflows/release.yml, line 226
node -e 'fetch("https://github.com/marketplace/actions/harness-score").then(r=>{if(!r.ok)throw Error(r.status);return r.text()}).then(t=>{const marker=`"latestRelease":{"tagName":"
Show more
.github/workflows/release.yml, line 232
[ "$runs" -ge 1 ] && node -e 'fetch("https://paladini.github.io/harness-score/").then(r=>{if(!r.ok)throw Error(r.status)})'
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
packages/cli/src/checks/hygiene.ts, line 7
const ENV_FILE_RE = /(^|\/)\.env(\.[^/]+)?$/;
packages/cli/src/checks/hygiene.ts, line 150
remediation: 'Add ".env" and ".env.*" to .gitignore so an agent can never stage credentials by accident.',
packages/cli/src/checks/hygiene.ts, line 156
? { passed: true, evidence: '.gitignore contains a .env pattern.' }
Show more
packages/cli/src/checks/hygiene.ts, line 157
: { passed: false, evidence: '.gitignore has no .env pattern.' };
packages/cli/src/checks/hygiene.ts, line 163
title: 'No unprotected .env files in the tree',
packages/cli/src/checks/hygiene.ts, line 166
"Remove committed .env files (keep only .env.example) or at minimum ensure .gitignore excludes them — env files in an agent's working tree leak into context and commits.",
packages/cli/src/checks/hygiene.ts, line 172
evidence: 'No real .env files in the tree (templates like .env.example are fine).',
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
package-lock.json, line 1
{
packages/cli/test/__snapshots__/golden-output.test.ts.snap, line 1
// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit b8c3941ba49e. can delete files. runs a script at install time. can reach github.com. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: b8c3941ba49edcf69f973e26c1940dae487f7c7a
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.