Borrowing it
Nothing to install: this file belongs to boldblackai/harness. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/boldblackai/harness/main/.agents/skills/analyze-image/SKILL.mdgit clone --depth 1 https://github.com/boldblackai/harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/boldblackai/harness/analyze-image)<a href="https://agentmods.dev/skills/boldblackai/harness/analyze-image"><img src="https://agentmods.dev/badge/skills/boldblackai/harness/analyze-image/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/boldblackai/harness/analyze-image"><img src="https://agentmods.dev/badge/skills/boldblackai/harness/analyze-image.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 52 Potential security issue detected. Manual review is recommended.Fix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
- medium MCP Rug Pull · line 44 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium MCP Rug Pull · line 51 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00119 | $0.00819 |
| Opus 5.5 | $0.00048 | $0.00328 |
| Sonnet 5.5 | $0.00024 | $0.00164 |
| Haiku 4.5 | $0.00012 | $0.00082 |
Grade A, and why
analyze-image scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Analyze Image Size
Produces a three-part breakdown of the harness Docker image:
- All available tags and their sizes
- Per-layer contribution (from
docker history) - Efficiency and waste report (from
dive --ci)
Step 1: Determine target image
Default to ghcr.io/boldblackai/harness:latest unless the user specifies a different tag.
Step 2: List all harness image tags
docker images ghcr.io/boldblackai/harness --format "table {{.Tag}}\t{{.Size}}\t{{.CreatedAt}}"
Step 3: Per-layer breakdown
docker history <image> --no-trunc --format "table {{.Size}}\t{{.CreatedBy}}"
Most layers will be 0B (metadata). Focus the summary on layers with non-zero size. Translate the raw CREATED BY commands into human-readable descriptions:
| Raw command fragment | Human label |
|---|---|
apt-get install / NodeSource setup |
"System packages + Node.js" |
corepack / pnpm install -g |
"pnpm + agent packages" |
COPY / chmod / mkdir |
"Config files / entrypoint" |
| Base layer (no command) | "Base OS (debian:stable-slim)" |
Step 4: Base image size
Read Dockerfile to find the FROM line and extract the base image reference (including the pinned digest). Pull it if needed and inspect its uncompressed size:
docker pull <base-image-with-digest> 2>/dev/null
docker inspect <base-image-with-digest> --format '{{.Size}}' | awk '{printf "%.0f MB\n", $1/1024/1024}'
Step 5: Dive efficiency analysis
docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
wagoodman/dive:latest --ci <image>
This outputs:
- Overall efficiency percentage
- Total wasted bytes
- A ranked list of inefficient files (files duplicated across layers)
Step 6: Report
Present the results as a unified report:
## Image size analysis: <image>
### Tags
<table of tag / size / created>
### Layer breakdown
| Size | Layer |
|--------|------------------------------|
| 100 MB | Base OS (debian:stable-slim) |
| 249 MB | System packages + Node.js |
| 429 MB | pnpm + agent packages |
| ~1 MB | Config files / entrypoint |
Base image accounts for X MB of the Y MB total.
### Efficiency (dive)
- Efficiency: XX%
- Wasted: XX MB
Top waste sources:
| Wasted | File | Likely cause |
|--------|------|--------------|
...
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 95 lines · 119 tokens per session scan A c1c127fdb40a
analyze-image is a skill published in the GitHub repository boldblackai/harness (14 stars, last pushed 4d ago), licensed MIT. It adds 119 tokens to every session and 819 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
analyze-image compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| analyze-imageboldblackai/harness | Skill | 14 | 4d ago | MIT | A | 119 | Claude Code, Codex |
| deploy-docker-composeomnigent-ai/omnigent | Skill | 11k | yesterday | Apache-2.0 | A | 84 | Claude Code, Codex |
| bdd-container-updateNVIDIA-AI-Blueprints/video-search-and-summarization | Skill | 2.0k | yesterday | Apache-2.0 | A | 117 | Cursor |
| securing-kubernetes-on-cloudxalgorix/xalgorix | Skill | 1.3k | yesterday | Apache-2.0 | A | 80 | Claude Code, Codex |
| detecting-privilege-escalation-in-kubernetes-podsxalgorix/xalgorix | Skill | 1.3k | yesterday | Apache-2.0 | A | 40 | Claude Code, Codex |
| docker-socket-mountPurpleAILAB/Decepticon | Skill | 6.5k | 8d ago | Apache-2.0 | B | 67 | Claude Code |
| k8s-networkingrohitg00/kubectl-mcp-server | Skill | 968 | 15d ago | MIT | A | 34 | Claude Code, Codex |