Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Arenukvern/skill_steward --skill harness-engineering-lifecyclegit clone --depth 1 https://github.com/Arenukvern/skill_stewardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arenukvern/skill_steward/harness-engineering-lifecycle)<a href="https://agentmods.dev/skills/arenukvern/skill_steward/harness-engineering-lifecycle"><img src="https://agentmods.dev/badge/skills/arenukvern/skill_steward/harness-engineering-lifecycle/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arenukvern/skill_steward/harness-engineering-lifecycle"><img src="https://agentmods.dev/badge/skills/arenukvern/skill_steward/harness-engineering-lifecycle.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.01385 |
| Opus 5 | $0.00044 | $0.00692 |
| Sonnet 5 | $0.00018 | $0.00277 |
| Haiku 4.5 | $0.00009 | $0.00138 |
Grade A, and why
harness-engineering-lifecycle scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to harness-engineering-lifecycle — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Harness Engineering Lifecycle
Evolve a proven repo-local contract into a generalized, high-performance, declarative harness system, then safely dogfood those changes across a producer-consumer repository boundary. Start here only after the target repo has a steward.yaml contract and at least an H2 smoke proof; use mcp-harness-repo-maintainer before that.
When to use
- Evolving custom validation scripts into a central linter engine.
- Extending
stewardCLI features for large polyrepos. - Testing a local CLI/harness build against a sibling repository to catch path-resolution crashes or integration friction.
- Turning repeated local benchmark/probe findings into a reusable harness feature.
When not to use
- Initial
steward.yamladoption or first quick probe in one repo — usemcp-harness-repo-maintainer. - Skill creation, registry updates, or marketplace packaging — use
skill-authoring-lifecycleorplugin-marketplace-setup. - Product-specific diagnostics before a cold-start contract exists — first add a bounded action, probe, and scenario in the target repo.
Part 1: The Cascading Agent Surface (Architecture & Generalization)
When engineering a harness beyond one local contract, follow the Cascading Agent Surface guidelines. A strict separation of tools vs skills can fail once repo workflows span multiple packages, adapters, or consumers. Instead, link them using domain-agnostic abstractions:
- Layer 0 (The Embedded Agent Surface): The target application or engine must natively expose its internal state via explicit hooks (e.g., RPC or memory probes). Do not rely on brittle UI scraping or black-box testing.
- Layer 1 (The Protocol Adapter): Build generalized MCP servers or protocol adapters to connect to Layer 0. These tools provide raw visibility and actuation (e.g., taking screenshots, reading memory) but must contain NO business logic.
- Layer 2 (The Orchestrator): Build specialized harness CLIs that use their own automation/scripting to chain multiple Layer 1 actions together. The Orchestrator's primary job is the Fast Feedback Loop: it must emit structured, diagnostic JSON to pinpoint exactly what broke across boundaries.
- Layer 3 (The AI Wrapper): Following the
agentskills.iospec, Skills can and should contain thin-wrapper tools (scripts). The Skill acts as the AI's brain: it teaches the AI how to trigger Layer 2, interpret its complex JSON heuristics, and safely execute domain-specific recovery tools.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 85 lines · 88 tokens per session scan A 5329b6b5d1a4
harness-engineering-lifecycle is a skill published in the GitHub repository Arenukvern/skill_steward (11 stars, last pushed 24d ago), licensed MIT. It adds 88 tokens to every session and 1,385 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to harness-engineering-lifecycle, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
testing-patterns
Plan, write, and maintain automated tests in any language, with worked examples in Python and JavaScript/TypeScript. Use this skill whenever the user wants to write or plan tests, apply TDD (red-green-refactor), structure unit tests with arrange-act-assert and given-when-then naming, choose between fakes, stubs, and…
bruno-api-testing
Create, run, and maintain API test collections using Bruno (OpenCollection YAML format and legacy Bru format). Use when the user wants to: (1) create a Bruno API test collection from scratch or from OpenAPI/Swagger specs, (2) write API request files with tests and assertions, (3) run API tests using bru CLI, (4)…
openspec-verify-change
Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
zsh-script-writer
Write and test Zsh scripts following project coding standards with ShellSpec BDD testing. Use when the user wants to: (1) create a new Zsh script, (2) write or fix ShellSpec tests for Zsh scripts, (3) review Zsh code for best practices, (4) add error handling or dependency checking to shell scripts, (5) implement API…
Test Engineer
Creates or completes a medium-coverage test suite: unit, component, and critical e2e flows.
convex-verify
Prove a Convex feature works — seed, drive as multiple mocked users via convex-test, assert behavior including the negative authz cases (wrong user refused, data-scope enforced).