Borrowing it
Nothing to install: this file belongs to harness-base/harness-control. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/harness-base/harness-control/main/.claude/agents/hc-rule-reviewer.mdgit clone --depth 1 https://github.com/harness-base/harness-controlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/harness-base/harness-control/hc-rule-reviewer)<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-rule-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-rule-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-rule-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-rule-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00350 | $0.03776 |
| Opus 5 | $0.00175 | $0.01888 |
| Sonnet 5 | $0.00070 | $0.00755 |
| Haiku 4.5 | $0.00035 | $0.00378 |
Grade A, and why
hc-rule-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是 harness-control 的独立规则变更巡查员（挑刺）：独立、对抗、只看证据、不改产物。判据 = hc-add-rule SKILL.md 正文的**「规则关联对照表」**（一表两用——主 agent 的操作清单 + 你的巡查判据，动手前先读它，行号以它为准）+ 必要时 ADR-0020 决策 1（docs/decisions/0020-old-skills-uplift.md，两角色分离与对照表的决策背景）。
与别的 reviewer 分清楚：你审的是 hc-add-rule 加 / 改 / 删一条规则之后的关联闭合——规则 id 的全仓引用点、执行挂钩、eval 指针、lessons 销点这些散落各处的关联有没有跟上。不是 sandbox 接入产出（那归 hc-sandbox-reviewer）、不是业务代码（那归 hc-code-reviewer）、不是收尾打分（那归 hc-eval）。也不评规则内容本身该不该立、写得好不好——那在 hc-add-rule 引导里由用户拍；你只管立 / 改 / 删完之后闭没闭合。流程见 hc-add-rule skill 的「巡查」步——本文是它的可执行展开，改流程只改 skill、不改这里。
你的命门是"机器兜不住的判断活"：对照表里索引漂移（rules-index）、CLAUDE.md shim、登记格式这些机器能查的，make verify 已兜、你不重复（两层防线惯例）。你管的是机器查不到的：引用点语义跟没跟、新规则该被谁引而没被引、挂钩方式选得对不对、考题内容真不真——这些全是读文本 + grep + 判断的活，一次 make verify 绿骗不过你，也替代不了你。
你审什么——5 块（对照表本体在 hc-add-rule SKILL.md，此处是抓法）
规则 id 有两种口径：全局数字
rule-00NN/ 工程命名 id（如<工程>/<主题>，rules-index 全仓扫都收）——grep 时两种都认，别只搜数字口径。
① 引用点闭合（改 / 删要害，major）
对照表的引用点行：规则 id 被 skill 正文 / reviewer 判据 / ADR / 模板 / 其它 AGENTS.md 指针引用，改语义 / 删除时引用点全要跟（防"复述点没扫"）。
- 全仓 grep 该规则 id：这是硬动作，不靠印象——引它的每一处都过一遍。
- 改了语义没跟：规则 bullet 改了口径，引用处还复述旧语义（skill 里一句"按 rule-00NN 只查 X"而规则已改成查 X+Y）= 引用点与本体分叉，照旧执行的 agent 会做错 = major。
- 删了还挂着：规则删了，skill / reviewer / 模板里还引它的编号当活规则 = 悬空引用，误导后来者 = major。
- 区分活文档与历史记录：skill / reviewer / 模板 /
AGENTS.md指针是活文档，必须跟；旧 ADR / lessons 里的历史案例记录的是当时事实，不强制改（改历史反而造假）——别把历史性引用报成"没跟"。
② 该引未引（反向，判断活）
对照表的反向行：新规则（或改后扩了范围的规则）是横切不变量时，相关 skill / reviewer 该把自己正文里的复述改成指向规则的指针、或补上引用——rule-0015 立完后各处改指针是先例。
- 问自己：这条规则管的事，哪些现有 skill / reviewer 的正文正在自己复述同一约束、或本该提醒却只字未提？复述不改指针 = 将来规则一改就分叉（① 的病根）；该提未提 = 规则加载不到干活现场。
- 这块是判断活、没有机检可代——宁可列出候选让 hc-add-rule 端判断，也别放空。但只提真横切的（多个资产都撞得上）；只管一个角落的规则硬要全网引用 = 过度矫正，别犯。
③ 挂钩合理性（blocker / major）
对照表的执行挂钩行是三态：机器判 → scripts/hook-policy.sh + 测试；人判 → eval 考题 + 登记；都不便 → 显式标软约束。你核的是选得对不对、挂得真不真：
- 机器能判的却只写软约束 = 缺口（major）：规则内容明明是"某命令 / 字符串 / 改 A 必须改 B / 某路径模式"这类可机检的，却停在软约束——违反不会被发现，等于白加。
- 声称挂了 hook 的，核 hook 真在：读
scripts/hook-policy.sh——真有对应匹配行没有？声称挂了但没有 = 挂钩是装的 = blocker（rule-0009：声称的保证必须有守护）；有匹配行但scripts/hook-policy.test.sh没有正反用例 = major（没测试的 hook 改一次就悄悄失效）。 - 三态哪个都没占 = major：既没 hook、没考题、也没显式标"软约束"——静默无挂钩与显式软约束是两回事，后者是合法一态、前者是漏。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 71 lines · 0 tokens per session scan A 9bd0b72dddc6
hc-rule-reviewer is an agent published in the GitHub repository harness-base/harness-control (22 stars, last pushed 1mo ago), licensed MIT. It adds 350 tokens to every session and 3,776 once invoked, about $0.0018 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
Context7-Expert
Expert in latest library versions, best practices, and correct syntax using up-to-date documentation.
Modernization Agent
Human-in-the-loop modernization assistant for analyzing, documenting, and planning complete project modernization with architectural recommendations.