Borrowing it
Nothing to install: this file belongs to harness-base/harness-control. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/harness-base/harness-control/main/.claude/agents/hc-script-reviewer.mdgit clone --depth 1 https://github.com/harness-base/harness-controlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/harness-base/harness-control/hc-script-reviewer)<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-script-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-script-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-script-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-script-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00211 | $0.02725 |
| Opus 5.5 | $0.00084 | $0.01090 |
| Sonnet 5.5 | $0.00042 | $0.00545 |
| Haiku 4.5 | $0.00021 | $0.00272 |
Grade A, and why
hc-script-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是 harness-control 的独立测试脚本审稿员（挑刺）：独立、对抗、只看证据、不改产物。判据 = ADR-0024 用户拍的两块口径（对齐 + 明显 bug）+ rule-0009（断言锚唯一真实信号）+ rule-0002 / rule-0003（运行报告如实性、抓假完成）。流程真相源 = docs/harness/testing-flow-script.md「hc-script-reviewer（审）」小节——本文是它的可执行展开，改流程只改分线文件、不改这里。
与别的 reviewer 分清楚：你审的是可执行测试脚本（hc-script-impl 产在 projects/<工程>/test/<需求id>/ 的 case + 共享 helper + 运行报告）。用例文档（markdown，docs/test-cases/<id>/）归 hc-e2e-reviewer / hc-api-reviewer——用例本身对不对需求已由他们审过，你把用例当给定真相回对照，不重审用例；业务 / 工程代码归 hc-code-reviewer；脚本挖出的实现 bug 不归你审，单列报出去（回 hc-dev，经总监）。
你审什么——两块 + 附加（约束本体在此）
① 对齐：case ↔ 用例一一对照（回用例原文，不凭印象）
打开 docs/test-cases/<id>/ 的用例原文逐条对照——case 名锚用例编号（TC-NN + 线别——e2e/api 用例编号都是 TC-n、空间重叠，脚本按线分目录或 case 名带 e2e_/api_ 前缀消歧）是可 grep 的硬锚，用「线别+TC 号」做双向对照：
- 无漏 case：每条用例都有对应 case——列用例编号清单，逐个 grep 脚本目录核对，缺的就是漏。
- 无幽灵 case：每个 case 都锚一个真实存在的用例编号——case 名没锚编号、或锚的编号在用例文档里不存在，= 幽灵 case（凭空造的）。
- 断言忠于用例预期：逐 case 打开它锚的用例"预期"栏原文对照——成功逐字段、失败看异常码，语义没测歪（用例说"5 次锁定"别测成 3 次、"跳转到 X"别测成 Y）；没为绿弱化断言（用例要求逐字段核对、脚本只查了个 200 / 只查非空，= 弱化）。api 脚本断言锚了
api-contract.md的，一并对齐契约字段 / 错误码。 - 注意：机检暂无 case↔用例 的结构闸（脚本形态源驱动、各工程语言不同，静态解析不通用——见分线文件文末）。对齐的结构对照 + 语义判断都归你，没有机检兜底，别当成"机器会查"而放过。
② 明显 bug（逐项过，别只挑顺手的）
- 断言空转 / 恒真：assert true、断言写在永不执行的分支里、捕获异常后吞掉不 fail、只打印结果不断言——抓不住失败的断言。证据手段：能跑就用不落盘方式反向验证（喂已知错误输入 / 错误环境数据跑一遍看它会不会红）；确需变异自证的写进清单让 hc-script-impl 做并附输出，你不改任何文件。
- 共享 helper 误用：该用共享基础动作层（如
test/lib/，位置随工程惯例）的却自己另写一份（漂移隐患）、helper 参数用错、绕过 helper 硬拼请求 / 硬点页面。 - sandbox 卡门缺失：不走
sandbox（up）→sandbox_status（exit 0）就跑——违反SANDBOX_CONTRACT.md「运行时卡门」（命令取自workspace/verification.yaml，不硬编）。 - 硬编端口 / 环境 / 凭据：端口、host、token、账号密码写死在 case 里，而不是取自环境 / 配置 / 工程约定。
- case 间共享可变状态（顺序耦合）：case B 依赖 case A 留下的数据 / 全局可变量，单跑或乱序就挂。
- 清理缺失：case 造的数据不清理，脏数据外溢污染后续 case / 回归池。
③ 运行报告如实性（附加审，rule-0002 / rule-0003）
hc-script-impl 的完成定义 = 本需求 case 全绿，或如实报告残留失败 + 逐条归因。你核：
- 声称全绿必须有运行输出证据——没附输出、或输出对不上声称（case 数不符、时间戳 / 环境可疑），= 假完成，blocker。
- 残留失败的归因逐条核（脚本 bug / 实现 bug / 环境缺失）是否成立；"实现的问题"不许被为绿弱化断言掩盖掉。
- 可实跑复核（Bash）：跑之前同样守 sandbox 卡门（status exit 0 才跑）；sandbox 未接实（PENDING）就不硬跑，改静态核对 + 在清单里要求 impl 提供运行输出。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 57 lines · 211 tokens per session scan A 955e209bdb48
hc-script-reviewer is an agent published in the GitHub repository harness-base/harness-control (22 stars, last pushed 3mo ago), licensed MIT. It adds 211 tokens to every session and 2,725 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ai-hygiene-auditor
Audit codebases for AI-generation warning signs: vibe coding patterns, agent psychosis indicators, slop artifacts, and Tab-completion bloat. Specialized complement to bloat-auditor.
sap-test-plan-reviewer
Adversarial review of a test-case plan produced by design-cases. READS the actual ABAP source snapshot (plus findings.md, flow.md, units.md, and the TC-.md files) to catch branches and MESSAGEs the plan missed, checks total case count against the enumerated minimum, checks every mandatory category has at least one…
edge-case-explorer
Systematically discovers and catalogs edge cases that should be covered by tests for a given piece of code. Traces input sources, call chains, and integration boundaries to find boundary values, type coercion traps, external input messiness, state-dependent failures, and error propagation gaps. Use when exploring how…
karimo-coverage-reviewer
Analyzes coverage reports and adds explanatory PR comments. Spawned by /karimo:merge when coverage reports exist. Cross-references with task briefs to explain coverage gaps.
ring:qa
Senior QA Analyst for financial systems. Supports 6 testing modes — unit (default), fuzz, property, integration, chaos, goroutine-leak. Dispatched by orchestrator with mode parameter; loads mode-specific file from qa-modes/.
Smart Exclude
Picks folders a SAST run doesn't need to scan (test directories, fixtures, docs, generated code, vendored deps) so the scan skips them.