# Resource-scan receipt: HarnessRouter/harnessrouter

A resource-scan receipt is the record of one static check run over one public AI resource — a repository, a gist, a skill file, a script, an MCP server package or a config — at the public URL named on the receipt. The receipt binds to the exact bytes scanned, named by their SHA-256 hash, and is sealed into the public ledger like every other record here. Each receipt carries the published check list with the outcome of every check and the findings in plain language. The analysis is static only: the bytes are read as text and are never executed, installed or run, and nothing is fetched from behind a login. A receipt publishes evidence, never a judgment: the summary line counts how many of the checks flagged, and the reader draws their own conclusion from the findings. Re-scanning the same URL creates a new receipt; the artifact page shows the latest receipt and the history, and when the bytes at a URL change the new receipt is a new version — no receipt is ever edited or overwritten.

The rightshold on https://github.com/HarnessRouter/harnessrouter — scanned 2026-11-04 · 4 of 8 checks flagged · receipt rsc_827ed22c3626e963515876e2, verify at rightshold.com/verify.

Artifact: HarnessRouter/harnessrouter
Canonical URL: https://github.com/HarnessRouter/harnessrouter
Fetched from: https://raw.githubusercontent.com/HarnessRouter/harnessrouter/HEAD/README.md
SHA-256 of the exact bytes scanned: 01dbc01eb92f2844f4c890ce516262b68de0d2fe62d8ed01e386340a405bd881
Bytes scanned: 24071 · Scanned: 2026-11-04T04:27:51.124Z · Scanner: resource-scan-v1
Summary: 4 of 8 checks flagged (evidence only — the findings below are the record)
Analysis: static only — the bytes were read as text and were never executed, installed or run.
Ledger entry: 8407

## Checks (latest receipt)

### Outbound network references — flag

The scanned bytes reference outbound network activity to these domains: api.star-history.com, discord.gg, github.com, harnessrouter.ai, hub.docker.com, img.shields.io, linkedin.com, raw.githubusercontent.com, unifiedharnessprotocol.org, www.star-history.com, x.com. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose.

Evidence: domain: api.star-history.com; domain: discord.gg; domain: github.com; domain: harnessrouter.ai; domain: hub.docker.com; domain: img.shields.io; domain: linkedin.com; domain: raw.githubusercontent.com; domain: unifiedharnessprotocol.org; domain: www.star-history.com; domain: x.com

### Credential and environment access — flag

The scanned bytes contain credential or environment access patterns: secret-named variables (API_KEY, SECRET, TOKEN, PASSWORD and similar names); authorization headers and bearer values. The receipt names the pattern kinds only; no credential value is reproduced here.

Evidence: secret-named variables (API_KEY, SECRET, TOKEN, PASSWORD and similar names); authorization headers and bearer values

### Install and postinstall hooks — pass

No install or postinstall hooks were found in the scanned bytes.

### Obfuscation and encoded payloads — pass

No obfuscation or encoded-payload signs were found in the scanned bytes.

### Shell-outs and download-and-execute — flag

The scanned bytes contain shell-out or download patterns: shell command tools named in the bytes (curl, wget, powershell). Code that runs shell commands acts with the full permissions of whoever runs it.

Evidence: shell command tools named in the bytes (curl, wget, powershell)

### Permission declarations vs behavior — flag

The bytes show network, credentials behavior, and no permissions declaration was found in the scanned bytes to compare it against.

Evidence: behavior: network; behavior: credentials

### Known-bad indicators — pass

None of the scanner's published known-bad indicator patterns matched the scanned bytes.

### Provenance facts (weak signals) — pass

Provenance facts, labeled weak signals — they say where the bytes sit, not what the bytes do: source host: github.com; repository: HarnessRouter/harnessrouter; bytes scanned: 24071; fetched from: https://raw.githubusercontent.com/HarnessRouter/harnessrouter/HEAD/README.md.

Evidence: source host: github.com; repository: HarnessRouter/harnessrouter; bytes scanned: 24071; fetched from: https://raw.githubusercontent.com/HarnessRouter/harnessrouter/HEAD/README.md

## History (2 receipts, 2 versions)

The bytes at this URL have changed across receipts: each distinct SHA-256 in the history is a distinct version of the artifact, recorded as its own receipt and never merged or overwritten.

- 2026-11-04 — 4 of 8 checks flagged · SHA-256 01dbc01eb92f2844… · 24071 bytes · scanner resource-scan-v1 · ledger entry 8407
- 2026-11-04 — 4 of 8 checks flagged · SHA-256 e9ce7dd2042aa35c… · 23955 bytes · scanner resource-scan-v1 · ledger entry 8201

Machine form: https://www.rightshold.com/v1/resource-scans/github-com-harnessrouter-harnessrouter-1d803e47e2