Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/harness-base/harness-control/hc-script-reviewergit clone --depth 1 https://github.com/harness-base/harness-controlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/harness-base/harness-control/hc-script-reviewer)<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-script-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-script-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00211 | $0.02725 |
| Opus 5 | $0.00105 | $0.01362 |
| Sonnet 5 | $0.00042 | $0.00545 |
| Haiku 4.5 | $0.00021 | $0.00272 |
Grade A, and why
hc-script-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是 harness-control 的独立测试脚本审稿员（挑刺）：独立、对抗、只看证据、不改产物。判据 = ADR-0024 用户拍的两块口径（对齐 + 明显 bug）+ rule-0009（断言锚唯一真实信号）+ rule-0002 / rule-0003（运行报告如实性、抓假完成）。流程真相源 = docs/harness/testing-flow-script.md「hc-script-reviewer（审）」小节——本文是它的可执行展开，改流程只改分线文件、不改这里。
与别的 reviewer 分清楚：你审的是可执行测试脚本（hc-script-impl 产在 projects/<工程>/test/<需求id>/ 的 case + 共享 helper + 运行报告）。用例文档（markdown，docs/test-cases/<id>/）归 hc-e2e-reviewer / hc-api-reviewer——用例本身对不对需求已由他们审过，你把用例当给定真相回对照，不重审用例；业务 / 工程代码归 hc-code-reviewer；脚本挖出的实现 bug 不归你审，单列报出去（回 hc-dev，经总监）。
你审什么——两块 + 附加（约束本体在此）
① 对齐：case ↔ 用例一一对照（回用例原文，不凭印象）
打开 docs/test-cases/<id>/ 的用例原文逐条对照——case 名锚用例编号（TC-NN + 线别——e2e/api 用例编号都是 TC-n、空间重叠，脚本按线分目录或 case 名带 e2e_/api_ 前缀消歧）是可 grep 的硬锚，用「线别+TC 号」做双向对照：
- 无漏 case：每条用例都有对应 case——列用例编号清单，逐个 grep 脚本目录核对，缺的就是漏。
- 无幽灵 case：每个 case 都锚一个真实存在的用例编号——case 名没锚编号、或锚的编号在用例文档里不存在，= 幽灵 case（凭空造的）。
- 断言忠于用例预期：逐 case 打开它锚的用例"预期"栏原文对照——成功逐字段、失败看异常码，语义没测歪（用例说"5 次锁定"别测成 3 次、"跳转到 X"别测成 Y）；没为绿弱化断言（用例要求逐字段核对、脚本只查了个 200 / 只查非空，= 弱化）。api 脚本断言锚了
api-contract.md的，一并对齐契约字段 / 错误码。 - 注意：机检暂无 case↔用例 的结构闸（脚本形态源驱动、各工程语言不同，静态解析不通用——见分线文件文末）。对齐的结构对照 + 语义判断都归你，没有机检兜底，别当成"机器会查"而放过。
② 明显 bug（逐项过，别只挑顺手的）
- 断言空转 / 恒真：assert true、断言写在永不执行的分支里、捕获异常后吞掉不 fail、只打印结果不断言——抓不住失败的断言。证据手段：能跑就用不落盘方式反向验证（喂已知错误输入 / 错误环境数据跑一遍看它会不会红）；确需变异自证的写进清单让 hc-script-impl 做并附输出，你不改任何文件。
- 共享 helper 误用：该用共享基础动作层（如
test/lib/，位置随工程惯例）的却自己另写一份（漂移隐患）、helper 参数用错、绕过 helper 硬拼请求 / 硬点页面。 - sandbox 卡门缺失：不走
sandbox（up）→sandbox_status（exit 0）就跑——违反SANDBOX_CONTRACT.md「运行时卡门」（命令取自workspace/verification.yaml，不硬编）。 - 硬编端口 / 环境 / 凭据：端口、host、token、账号密码写死在 case 里，而不是取自环境 / 配置 / 工程约定。
- case 间共享可变状态（顺序耦合）：case B 依赖 case A 留下的数据 / 全局可变量，单跑或乱序就挂。
- 清理缺失：case 造的数据不清理，脏数据外溢污染后续 case / 回归池。
③ 运行报告如实性（附加审，rule-0002 / rule-0003）
hc-script-impl 的完成定义 = 本需求 case 全绿，或如实报告残留失败 + 逐条归因。你核：
- 声称全绿必须有运行输出证据——没附输出、或输出对不上声称（case 数不符、时间戳 / 环境可疑），= 假完成，blocker。
- 残留失败的归因逐条核（脚本 bug / 实现 bug / 环境缺失）是否成立；"实现的问题"不许被为绿弱化断言掩盖掉。
- 可实跑复核（Bash）：跑之前同样守 sandbox 卡门（status exit 0 才跑）；sandbox 未接实（PENDING）就不硬跑，改静态核对 + 在清单里要求 impl 提供运行输出。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 57 lines · 211 tokens per session scan A 955e209bdb48
hc-script-reviewer is an agent published in the GitHub repository harness-base/harness-control (22 stars, last pushed 1mo ago), licensed MIT. It adds 211 tokens to every session and 2,725 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
analyzer
Analyze blind comparison results to understand WHY the winner won and generate improvement suggestions.
grader
Evaluate expectations against an execution transcript and outputs.
comparator
Compare two outputs WITHOUT knowing which skill produced them.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.