skill-harness AGENTS.md

Maintainer instructions for Skill Harness, a repository that installs and organizes reusable agent skills and task-focused agents. It also explains how trusted maintainers handle repository tasks and Beads, an issue-tracking system.

In plain words
What is it for?
Use it while maintaining the Skill Harness repository, selecting an appropriate agent, updating embedded skill packs, or closing tracked work.
Why use it?
It gives coding agents and maintainers consistent rules for choosing skills, delegating work, and completing repository tasks.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/45ck/skill-harness/agents-md
Clone the repo
git clone --depth 1 https://github.com/45ck/skill-harness

Made for: Codex, OpenCode.

Per session 1,545 This file is loaded in full into every session.
When invoked 1,545 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01545 $0.01545
Opus 5 $0.00772 $0.00772
Sonnet 5 $0.00309 $0.00309
Haiku 4.5 $0.00154 $0.00154

Measured 2d ago against content hash 6c86ece1d356, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

skill-harness AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 85 lines

How it starts

The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Skill Harness

This repository provides the umbrella install and setup layer for the 45ck stack.

Audience note:

  • This file is maintainer and agent operating guidance. Public contributors should start with CONTRIBUTING.md, SUPPORT.md, and SECURITY.md.
  • Direct push and Beads closeout rules apply to trusted maintainer/agent sessions on repository branches. Fork-based contributors should use pull requests and do not need Beads locally.

Guidelines:

  • Use the narrowest agent that can own the task end to end.
  • Escalate to another specialist when the work crosses a real boundary, not just for vocabulary changes.
  • Prefer the curated skills listed in each agent before reaching for unrelated skills.
  • Treat packs as the capability library and agents as the workflow loadout.
  • Treat this repo as the suite entrypoint and project setup repo, including embedded packs under packs/.
  • Treat frontier-agent-playbook as the shared doctrine companion when a task needs frontier-capability priors, agentic thinking, or anti-fallback framing.

UML-first artifacts:

  • Auto-detect model impact for every engineering change. If code, API, workflow, dependency, deployment, UI structure, or agent behavior changes, update the relevant canonical model source or record why no model change is required.
  • Use the modeling system by default for fresh developer-artifact setups. --modeling-mode auto preserves legacy repos, defaults fresh repos to uml-first, and can be overridden with --modeling-mode off|baseline|uml-first or --skip-modeling.
  • Keep canonical UML/UWE/C4/evidence model sources in repo-relative text files, preferring docs/artifacts/source/models/ when no domain-specific docs path is better.
  • Keep docs/artifacts/source/models/model-inventory.md and docs/artifacts/artifacts.manifest.json aligned with model ids, owners, methods, source paths, evidence, and generated review surfaces.
  • Human review artifacts for models must be static HTML under generated/review/models/, generated from source with node scripts/generate-model-review.mjs, and validated with the model and HTML policy checks.
  • Human-facing discovery, research, product, business, data, UX, and planning artifacts that are meant for review must use the same source-plus-HTML path: canonical source under docs/artifacts/source/<family>/, generated infographic HTML under generated/review/<family>/, manifest entry with reviewRequired: true, and node scripts/generate-artifact-review.mjs.
  • Do not hand off Markdown-only for human artifacts unless the active profile is CLI/TUI or the task is explicitly source-only. In Codex app or desktop review contexts, surface the generated HTML path or open it with the best available browser surface.
  • Open generated HTML in the best human review surface for the current environment. In Codex app, use the Browser plugin for local HTML when available; in Claude desktop, use the built-in browser/preview when available; in CLI-only contexts, use node scripts/open-artifact-review.mjs to open the system default browser or print the file URL in headless/CI contexts.
  • Use node scripts/open-artifact-review.mjs --json --print when an agent or host app needs to auto-detect the artifact target and choose between Codex Browser, Claude preview, system browser, or a local HTTP preview fallback.
  • Treat HTML, SVG, PNG, screenshots, and generated comparison pages as review surfaces only. Source files and model diffs remain canonical.

Visual source-first artifacts:

  • Use the same source-first split for product, business, data, research, UX, and mockup work: canonical agent-readable source first, generated visual human review surface second.
  • Prefer docs/artifacts/source/product/, business/, data/, research/, and ux/ for canonical sources when no domain-specific docs path is better; place generated human surfaces under matching generated/review/ subfolders.
  • High-fidelity HTML/prototype review is the default for UI, product, customer-facing workflow, and mockup artifacts. Low-fidelity sketches are scratch only unless captured as explicit research evidence.
  • Infographic-style HTML is the default human surface for non-model artifacts: include scan-friendly summary metrics, inline SVG/CSS charts or diagrams, evidence/freshness panels, source links, and CSS-only interaction by default.
  • Use the open-source infographic toolkit as source/spec renderers, not browser runtimes: Mermaid for authored diagrams, Vega-Lite as the default chart grammar, Observable Plot for compact exploratory charts, D3 for bespoke static layouts, Graphviz for node-edge maps, ECharts only as generation-time/static output, RAWGraphs for exported design-led SVGs, and Chart.js only as server-rendered/static output or equivalent.
  • For generic artifact pages, prefer artifact-infographic JSON fences or manifest infographics entries so charts and graphs regenerate with node scripts/generate-artifact-review.mjs.
  • Record generated visual artifacts in docs/artifacts/artifacts.manifest.json with source, review surface, owner, evidence links, status, and freshness. Label synthetic user or agent-simulation evidence separately from real user/customer evidence.
  • Use a team of agents when ownership crosses boundaries: requirements for product intent, delivery for business constraints, backend for data shape, research for evidence, UX for high-fidelity review, system-modeler for structural impact, and quality-reviewer for readiness gates.

Read the full file on GitHub · 85 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 85 lines · 1,545 tokens per session scan A 6c86ece1d356

Subscribe to this mod's changes

skill-harness AGENTS.md is an instructions file published in the GitHub repository 45ck/skill-harness (15 stars, last pushed 2mo ago), licensed MIT. It adds 1,545 tokens to every session, about $0.0077 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.