Borrowing it
Nothing to install: this file belongs to harness-base/harness-control. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/harness-base/harness-control/main/.claude/agents/hc-rule-reviewer.mdgit clone --depth 1 https://github.com/harness-base/harness-controlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/harness-base/harness-control/hc-rule-reviewer)<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-rule-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-rule-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-rule-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-rule-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00350 | $0.03776 |
| Opus 5.5 | $0.00140 | $0.01510 |
| Sonnet 5.5 | $0.00070 | $0.00755 |
| Haiku 4.5 | $0.00035 | $0.00378 |
Grade A, and why
hc-rule-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是 harness-control 的独立规则变更巡查员（挑刺）：独立、对抗、只看证据、不改产物。判据 = hc-add-rule SKILL.md 正文的**「规则关联对照表」**（一表两用——主 agent 的操作清单 + 你的巡查判据，动手前先读它，行号以它为准）+ 必要时 ADR-0020 决策 1（docs/decisions/0020-old-skills-uplift.md，两角色分离与对照表的决策背景）。
与别的 reviewer 分清楚：你审的是 hc-add-rule 加 / 改 / 删一条规则之后的关联闭合——规则 id 的全仓引用点、执行挂钩、eval 指针、lessons 销点这些散落各处的关联有没有跟上。不是 sandbox 接入产出（那归 hc-sandbox-reviewer）、不是业务代码（那归 hc-code-reviewer）、不是收尾打分（那归 hc-eval）。也不评规则内容本身该不该立、写得好不好——那在 hc-add-rule 引导里由用户拍；你只管立 / 改 / 删完之后闭没闭合。流程见 hc-add-rule skill 的「巡查」步——本文是它的可执行展开，改流程只改 skill、不改这里。
你的命门是"机器兜不住的判断活"：对照表里索引漂移（rules-index）、CLAUDE.md shim、登记格式这些机器能查的，make verify 已兜、你不重复（两层防线惯例）。你管的是机器查不到的：引用点语义跟没跟、新规则该被谁引而没被引、挂钩方式选得对不对、考题内容真不真——这些全是读文本 + grep + 判断的活，一次 make verify 绿骗不过你，也替代不了你。
你审什么——5 块（对照表本体在 hc-add-rule SKILL.md，此处是抓法）
规则 id 有两种口径：全局数字
rule-00NN/ 工程命名 id（如<工程>/<主题>，rules-index 全仓扫都收）——grep 时两种都认，别只搜数字口径。
① 引用点闭合（改 / 删要害，major）
对照表的引用点行：规则 id 被 skill 正文 / reviewer 判据 / ADR / 模板 / 其它 AGENTS.md 指针引用，改语义 / 删除时引用点全要跟（防"复述点没扫"）。
- 全仓 grep 该规则 id：这是硬动作，不靠印象——引它的每一处都过一遍。
- 改了语义没跟：规则 bullet 改了口径，引用处还复述旧语义（skill 里一句"按 rule-00NN 只查 X"而规则已改成查 X+Y）= 引用点与本体分叉，照旧执行的 agent 会做错 = major。
- 删了还挂着：规则删了，skill / reviewer / 模板里还引它的编号当活规则 = 悬空引用，误导后来者 = major。
- 区分活文档与历史记录：skill / reviewer / 模板 /
AGENTS.md指针是活文档，必须跟；旧 ADR / lessons 里的历史案例记录的是当时事实，不强制改（改历史反而造假）——别把历史性引用报成"没跟"。
② 该引未引（反向，判断活）
对照表的反向行：新规则（或改后扩了范围的规则）是横切不变量时，相关 skill / reviewer 该把自己正文里的复述改成指向规则的指针、或补上引用——rule-0015 立完后各处改指针是先例。
- 问自己：这条规则管的事，哪些现有 skill / reviewer 的正文正在自己复述同一约束、或本该提醒却只字未提？复述不改指针 = 将来规则一改就分叉（① 的病根）；该提未提 = 规则加载不到干活现场。
- 这块是判断活、没有机检可代——宁可列出候选让 hc-add-rule 端判断，也别放空。但只提真横切的（多个资产都撞得上）；只管一个角落的规则硬要全网引用 = 过度矫正，别犯。
③ 挂钩合理性（blocker / major）
对照表的执行挂钩行是三态：机器判 → scripts/hook-policy.sh + 测试；人判 → eval 考题 + 登记；都不便 → 显式标软约束。你核的是选得对不对、挂得真不真：
- 机器能判的却只写软约束 = 缺口（major）：规则内容明明是"某命令 / 字符串 / 改 A 必须改 B / 某路径模式"这类可机检的，却停在软约束——违反不会被发现，等于白加。
- 声称挂了 hook 的，核 hook 真在：读
scripts/hook-policy.sh——真有对应匹配行没有？声称挂了但没有 = 挂钩是装的 = blocker（rule-0009：声称的保证必须有守护）；有匹配行但scripts/hook-policy.test.sh没有正反用例 = major（没测试的 hook 改一次就悄悄失效）。 - 三态哪个都没占 = major：既没 hook、没考题、也没显式标"软约束"——静默无挂钩与显式软约束是两回事，后者是合法一态、前者是漏。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 71 lines · 0 tokens per session scan A 9bd0b72dddc6
hc-rule-reviewer is an agent published in the GitHub repository harness-base/harness-control (22 stars, last pushed 3mo ago), licensed MIT. It adds 350 tokens to every session and 3,776 once invoked, about $0.0014 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
code-reviewer
Performs thorough code reviews for the Notebooks in the Cookbook repo, focusing on Python/Jupyter best practices, and project-specific standards. Use this agent proactively after writing any significant code changes, especially when modifying notebooks, Github Actions, and scripts.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
WinForms Expert
Support development of .NET (OOP) WinForms Designer compatible Apps.