Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/nongjun/awesome-harness-engineering/apigit clone --depth 1 https://github.com/nongjun/awesome-harness-engineeringWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00457 |
| Opus 5 | $0.00000 | $0.00229 |
| Sonnet 5 | $0.00000 | $0.00091 |
| Haiku 4.5 | $0.00000 | $0.00046 |
Grade A, and why
测试后端Api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to 测试后端Api — 12 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
后端 API 测试
对当前项目的所有后端服务进行一次全量 API 测试。
自动发现服务
通过以下方式自动发现项目中的后端服务：
docker ps获取运行中的后端容器及端口docker compose config或docker-compose*.yml获取服务定义- Nginx 配置获取域名与路由映射
测试账户
自动获取测试凭据：
- 从项目
.env或容器环境变量中读取数据库连接信息 - 从数据库查询管理员账户
- 使用项目配置的密钥和算法生成 JWT Token（从环境变量中获取
JWT_SECRET/SECRET_KEY等） - 若项目有登录接口，也可通过登录获取 Token
测试范围
对每个发现的后端服务执行：
- 健康检查 —
GET /health或/api/health，验证返回 200 - 核心列表接口 — 带分页参数请求，验证返回结构包含列表数据和分页信息
- 批量操作空数组 — POST 空数组到批量接口，验证返回 400 或合理的错误提示
- 创建接口校验 — 传入非法数据（超长字段、缺必填项），验证被正确拒绝
鉴权受阻时的降级策略
若某接口因权限返回 401/403：
- 尝试使用不同权限级别的 Token 重试
- 在容器内直接验证代码逻辑（
docker exec <容器名>执行验证命令） - 记录为"需要更高权限"，不标为失败
安全头检查
对所有 HTTPS 域名检查响应头：
Strict-Transport-SecurityX-Content-Type-OptionsX-Frame-OptionsReferrer-Policy
输出格式
在对话中用表格汇总，每项标注 ✅/❌，最后统计通过率。不生成报告文件。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 47 lines · 0 tokens per session scan A 974dd4db7c81
测试后端Api is a command published in the GitHub repository nongjun/awesome-harness-engineering (2 stars, last pushed 5mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 457 tokens. A static security scan graded it A with 0 findings. It is 100% identical to 测试后端Api, differing in 12 lines, and is treated as a copy.
Other commands, from other repositories
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.
specify
Create or update the feature specification from a natural language feature description.
analyze
Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation.
constitution
Create or update the project constitution from interactive or provided principle inputs.
converge
Assess the current codebase against the feature's spec, plan, and tasks, then append any remaining unbuilt work as new tasks to tasks.md so implement can complete it.