Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/alchemiststudiosdotai/tunacode/audit-harnessnpx skills add alchemiststudiosDOTai/tunacode --skill audit-harnessgit clone --depth 1 https://github.com/alchemiststudiosDOTai/tunacodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alchemiststudiosdotai/tunacode/audit-harness)<a href="https://agentmods.dev/skills/alchemiststudiosdotai/tunacode/audit-harness"><img src="https://agentmods.dev/badge/skills/alchemiststudiosdotai/tunacode/audit-harness.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.00746 |
| Opus 5 | $0.00034 | $0.00373 |
| Sonnet 5 | $0.00014 | $0.00149 |
| Haiku 4.5 | $0.00007 | $0.00075 |
Grade A, and why
audit-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit Harness
HARNESS.md is mission-critical. Audit it with zero tolerance.
Trigger
Use this skill when the user asks to:
- audit
HARNESS.md - verify harness accuracy
- run pre-commit or pre-push hooks manually
- confirm architecture or CI gates
- explain what actually enforces the harness
Hard Rules
- Treat any mismatch, omission, skipped gate, auto-fix, or failing check as a critical failure.
- Never describe results as "mostly passing", "just one failure", or equivalent minimization.
- State the exact failure first.
- Explain the finding before changing code or docs.
- Do not proceed with a fix until the user tells you to proceed.
- During harness audits, never use
make check,scripts/run_gates.py, or any loop/script wrapper as the primary audit path. - Run checks manually, one by one, in the same order they appear in the source-of-truth config.
- If a hook modifies files, report the exact files immediately.
- Do not revert hook changes unless the user explicitly asks.
Source Of Truth Order
Read these first:
HARNESS.md.pre-commit-config.yamlMakefiletests/test_dependency_layers.pyscripts/grimp_layers_report.py.github/workflows/*.ymldocs/git/practices.mdAGENTS.md
Manual Audit Procedure
Pre-commit
- Enumerate the active pre-commit hooks from
.pre-commit-config.yaml. - Start at the top.
- Run each hook manually:
uv run pre-commit run <hook-id> --all-files
- After each hook:
state
Passed,Failed,Skipped, orModified files. - If a hook fails, stop and explain why before proposing a fix.
Pre-push
- Enumerate the active pre-push hooks from
.pre-commit-config.yaml. - Run each one manually, one by one:
uv run pre-commit run <hook-id> --hook-stage pre-push --all-files
- Treat any failure as critical.
Architecture
tests/test_dependency_layers.pyis the source of truth forgrimpenforcement.scripts/grimp_layers_report.pyis report generation only.scripts/run_gates.pyis supplemental only and not canonical.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 102 lines · 69 tokens per session scan A be146927dfad
audit-harness is a skill published in the GitHub repository alchemiststudiosDOTai/tunacode (124 stars, last pushed 1mo ago), licensed MIT. It adds 69 tokens to every session and 746 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
baby-sit
Monitor a GitHub pull request until CI is green, diagnose failures, and rerun only evidence-backed flaky GitHub Actions jobs.
meta-long-running-build-watchdog
Watches a long-running command via tmux, lets sub-agent diagnose failures and propose a fix, and records the diagnosis to memory. Designed for overnight model fine-tunes, CI image builds, or repeated regression suites that may fail intermittently.
knowledge-engineering-quality-and-delivery-build-release-and-documentation
覆盖 Bun/Vite/VS Code 构建、npm 包边界、版本与 tag 发布、GitHub Actions、vendor 资产、 双语用户文档和 changelog 生成链。 Navigate when: 修改构建输出、依赖分类、包内容、版本号、发布脚本/workflow、Docsify 导航、双语文档或发布后验证。 Excludes: 测试矩阵语义（见 ../real-api-qualification-and-e2e/）； 性能、安全和快照阈值（见 ../performance-security-and-snapshot-gates/）。 Keywords: Bun.build, Vite, dist, package…
knowledge-engineering-quality-and-delivery
覆盖 Blade Code 跨测试、构建、资格验证、发布与双语文档的工程质量闭环。 Navigate when: 调整测试分层、CI 门禁、真实 API 准出、构建产物、npm 发布或文档同步。 Excludes: 具体运行时业务语义（转到对应功能域）；各门禁实现细节继续进入本节点的四个子节点。 Keywords: quality gate, qualification, Vitest, real API, performance, security, snapshot, build, release, npm, GitHub Actions, Docsify, changelog.
deploy
Deploy the application or manage infrastructure. Handles Docker builds, CI/CD, and deployment workflows.
ci-cd-and-automation
Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.