harbor lint checks task configuration, files, and common security risks without running a sandbox.

harbor lint ./task-one ./task-two
harbor lint --json ./task-one
harbor lint --ignore shared-verifier --ignore root-agent ./task-one

All rules run by default. Repeat --ignore to exclude any rule by name.

Task checks

Rule	Reports
`invalid-task-config`	Invalid task or Compose configuration.
`unknown-config-field`	Unknown configuration fields, with spelling suggestions.
`invalid-task-files`	Missing required files or `environment/`, empty instructions, or unsafe input paths.
`root-agent`	An omitted or root agent user, including step overrides.
`shared-verifier`	A verifier sharing the agent sandbox.
`artifact-log-overlap`	Artifacts overlapping a separate verifier’s protected agent or verifier log paths.

Compose checks

Requires the Docker CLI. Tasks without Compose files do not run these checks. Harbor runtime variables use placeholder values; runtime host mounts are flagged as potentially external. Compose interpolation uses the applicable agent or verifier environment configuration; task values override shell values.

Rule	Reports
`compose-privileged`	Privileged services or lifecycle hooks.
`compose-additional-capabilities`	Capabilities requested through `cap_add`.
`compose-writable-bind-mount`	Host bind mounts with write access.
`compose-external-bind-mount`	Bind sources that resolve outside the task directory.
`compose-symlink-bind-mount`	Bind sources that traverse a symlink and resolve outside the task directory.

Final thoughts

Task linting is optional and many rules are recommendations. Feel free to ignore rules at your convenience. Most rules exist to encourage best practices.

Static linting complements the rubric-based harbor check and harbor analyze and does not guarantee task or verifier correctness.