Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/hmj1026/dhpkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/hmj1026/dhpk/package)<a href="https://agentmods.dev/plugins/hmj1026/dhpk/package"><img src="https://agentmods.dev/badge/plugins/hmj1026/dhpk/package/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/hmj1026/dhpk/package"><img src="https://agentmods.dev/badge/plugins/hmj1026/dhpk/package.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
dhpk scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
94% identical to dhpk — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 538 lines — stays where its author put it; the contents beside it link to each section on GitHub.
{
"$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
"name": "dhpk",
"displayName": "DHPK Dev Harness",
"version": "0.66.4",
"description": "Reusable Claude Code harness with role-based agents, routed commands, advisory reviewer dispatch, opt-in PHP, Yii, PHPUnit, Laravel, JavaScript, Python, React, Next.js, and iOS/Swift modules, plus a parallel Codex CLI projection.",
"author": {
"name": "hmj1026",
"url": "https://github.com/hmj1026"
},
"license": "MIT",
"homepage": "https://github.com/hmj1026/dhpk",
"keywords": [
"harness",
"codex",
"code-review",
"php",
"yii",
"phpunit",
"laravel",
"vue",
"swift",
"ios",
"swiftui"
],
"skills": [
"./skills/"
],
"agents": [
"./agents/agy-worker.md",
"./agents/architect.md",
"./agents/code-reviewer.md",
"./agents/codex-reasoner.md",
"./agents/codex-reviewer.md",
"./agents/codex-worker.md",
"./agents/database-reviewer.md",
"./agents/deep-reasoner.md",
"./agents/doc-reviewer.md",
"./agents/doc-updater.md",
"./agents/docs-lookup.md",
"./agents/e2e-runner.md",
"./agents/fast-worker.md",
"./agents/frontend-reviewer.md",
"./agents/harness-reviser.md",
"./agents/migration-reviewer.md",
"./agents/performance-analyzer.md",
"./agents/planner.md",
"./agents/python-build-resolver.md",
"./agents/refactor-cleaner.md",
"./agents/rust-build-resolver.md",
"./agents/security-reviewer.md",
"./agents/silent-failure-hunter.md",
"./agents/smoke-tester.md",
"./agents/swift-build-resolver.md",
"./agents/tdd-guide.md",
"./agents/type-design-analyzer.md",
"./agents/ui-ux-verifier.md",
"./agents/version-matrix-impact-reviewer.md",
"./modules/library-author/agents/polyfill-reviewer.md"
],
"commands": [
"./commands/",
"./modules/js/commands/"
],
"userConfig": {
"hook_profile": {
"type": "string",
"title"What it installs
The manifest is a name and a version. 39 skills, 1 command, 1 agent, 3 hooks travel with it, and installing the plugin installs all of them — 3,101 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill dhpk-deploy-list A 151 tokens
- Skill code-trace A 81 tokens
- Skill dhpk-legacy-characterization-tests A 108 tokens
- Skill flow-guide A 61 tokens
- Skill git-smart-commit A 86 tokens
- Skill code-simplify A 62 tokens
- Skill dhpk-issue-analyze A 77 tokens
- Skill dhpk-openspec-artifact-guard A 60 tokens
- Skill dhpk-vue-2-notes A 181 tokens
- Skill proposal-analyze A 54 tokens
- Skill release-creator A 64 tokens
- Skill tdd-workflow A 108 tokens
- Skill harness-setup A 53 tokens
- Skill opsx-apply-resume A 72 tokens
- Skill project-brief A 42 tokens
- Skill ui-ux-verify A 89 tokens
- Skill dhpk-repo-intake A 61 tokens
- Skill precommit A 54 tokens
- Skill flow-drive A 64 tokens
- Skill change-verdict A 85 tokens
- Skill dhpk-feature-verify A 98 tokens
- Skill laravel A 91 tokens
- Skill module-design A 66 tokens
- Skill php A 67 tokens
- Skill swift A 71 tokens
- Skill yii1 A 72 tokens
- Skill create-pr A 59 tokens
- Skill js-static-checks A 67 tokens
- Skill nextjs A 75 tokens
- Skill phpunit A 86 tokens
- Skill python A 66 tokens
- Skill library-author A 68 tokens
- Skill react A 69 tokens
- Skill repo-verify A 64 tokens
- Skill doc-maintain A 61 tokens
- Skill git-worktree A 63 tokens
- Skill merge-prep A 68 tokens
- Skill pr-summary A 67 tokens
- Skill dhpk-project-audit A 64 tokens
- Command ts-check-status A 17 tokens
- Agent polyfill-reviewer A 129 tokens
- Hook PreToolUse A not measured
- Hook SessionStart A not measured
- Hook SubagentStop A not measured
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 68d1b8db84a2
- yesterday Changed · -16 lines ea5c3050a904
- 2d ago Changed 7f451ccb6fde
- 8d ago Changed ce5d458c8760
- 10d ago Changed · -2 lines f26b40694a5c
- 15d ago Changed 3cbc1d05276c
- 18d ago Changed 258b075a0c28
- 20d ago Changed 00b74ebfc9a6
- 21d ago Changed a7b9f8cb7530
- 22d ago First seen · 556 lines scan A efa2a7a0df7a
dhpk is a plugin published in the GitHub repository hmj1026/dhpk (2 stars, last pushed today), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. It is 94% identical to dhpk, differing in 0 lines, and is treated as a copy.
Other plugins, from other repositories
mumei
Quality Enforcement Layer for Claude Code — Hook-gated SDD (spec & plan vehicles), Wave commits, and grounded multi-agent code review.
argus-claude marketplace
Multi-agent code quality and architecture review with cross-validation.
argus
Multi-agent code quality and architecture review with cross-validation.
mad-scientist-skills
Architecture auditing (beta: Hexagonal/Ports & Adapters, Domain-Driven Design, Clean Architecture, SOLID principles, coupling/cohesion analysis, bounded context assessment), C4 architecture diagrams (Structurizr DSL), cognitive interface auditing (GOMS task models, Norman's Gulfs, Wood 7-layer error tolerance, Gergle…
piercelamb-plugins marketplace
Claude Code plugins by Pierce Lamb.
humanizer
Rewrite AI-sounding text so it reads like the writer without changing what it says.