Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add btspoony/mstar-harness --skill mstar-harness-coregit clone --depth 1 https://github.com/btspoony/mstar-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/btspoony/mstar-harness/mstar-harness-core)<a href="https://agentmods.dev/skills/btspoony/mstar-harness/mstar-harness-core"><img src="https://agentmods.dev/badge/skills/btspoony/mstar-harness/mstar-harness-core/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/btspoony/mstar-harness/mstar-harness-core"><img src="https://agentmods.dev/badge/skills/btspoony/mstar-harness/mstar-harness-core.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 133 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium System Prompt Leakage · line 176 Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.Fix: Guard against indirect extraction by refusing to summarize, translate, or rephrase system instructions. Add explicit anti-extraction clauses.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00301 | $0.04246 |
| Opus 5 | $0.00151 | $0.02123 |
| Sonnet 5 | $0.00060 | $0.00849 |
| Haiku 4.5 | $0.00030 | $0.00425 |
Grade A, and why
mstar-harness-core scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Morning Star Harness Core（启明星核心）
本 skill 是 harness 的唯一全局入口与裁决层。专题 skill 展开细节；冲突时以本 skill 的状态机、Done 权限与索引为准。
与其它 mstar-* skill 的加载契约
- 本 skill 是 harness 的生命周期 / 授权语义权威（状态机、Done 权限、门禁、路由以本 skill 为准）；加载选择权威是
mstar-roles（hub bootstrap → 角色身份 → AssignmentSkill presets:决策，见其 § Load Order）。本 skill 不维护第二份全局必读角色表。 - 独立直接调用专题（不经角色 hub bootstrap）时，
mstar-harness-core仍是首个依赖：各专题 SKILL.md 的 Load Order / First action 节须声明 core-first。唯一例外是mstar-roleshub bootstrap —— explicitnone下角色以身份 + 角色自有方法自洽，不强制读任何专题（含本 skill）；此时授权、反递归、证据诚实等 load-bearing 语义由角色引用与其 leaf 边界承接。 - 各专题 SKILL.md 含 Load order；按
mstar-roles的加载选择 + 本 skill 专题索引按需加载，禁止为「保险」通读全部专题。 - 加载条件（
mstar-engine-legacy）：mstar-engine-legacy是条件契约档案（engine-absent fallback）。engine 约束激活（或宿主含 engine 能力）时不加载——engine-present 宿主以运行时 skills 的 engine-check 指针 + engine 校验为权威；仅 engine-absent 宿主（无mstarCLI / engine import）为找回被 engine 校验接管的 contract 全文而读取（触发契约见其 description）。
Standalone harness（mstar-* 自洽）
mstar-*skill 体系在本仓库内自洽运行：正文与 load order 不得依赖仓库外的 skills、CLI、或 MCP 服务。- Commands（如
/iteration-start）可引用本仓库 bundled、非mstar-*的辅助资产（例如skills/grill-me/）；该引用仅存在于 command 层，不进入mstar-*专题索引或 load matrix。 - 框架/SDK/API 问题：先 Read/Grep 项目内文档、规格与源码；仍不确定时再向用户澄清。不将第三方文档工具写入
mstar-*必读路径。
信息源优先级
- 当轮用户显式指令
- 项目
AGENTS.md/CLAUDE.md {KNOWLEDGE_DIR}/README.md索引（若该文件存在；发现 Active 行并仅跟随与当轮相关的文档）mstar-*skills（本 skill + 专题）mstar-roles角色正文
冲突且用户未覆盖 → 暂停升级人工。Knowledge 永不高于用户 / AGENTS.md。
最小交付循环
per-plan：specify → clarify → plan → plan(locked) → tasks → implement（多 task 默认 SDD）→ plan QC tri + QA gate（mandatory 派 QA 或 pm-acceptance）→ Done（inline 单席例外）。阶段细则 → mstar-phase-gates；QA 分级 → mstar-roles/references/project-manager/qa-trigger-matrix.md。
迭代级：iteration-start → [per-plan cycle × N] → iteration-close → PR delivery → PR merge-ready loop。细则 → mstar-iteration。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +7 lines · +42 tokens per session c7ca1bdd456c
- 2d ago Changed · -44 lines · +38 tokens per session 57baa768e4f5
- 11d ago First seen · 197 lines · 221 tokens per session scan A 45042d92d612
mstar-harness-core is a skill published in the GitHub repository btspoony/mstar-harness (58 stars, last pushed today), licensed MIT. It adds 301 tokens to every session and 4,246 once invoked, about $0.0015 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
comet-native
A workflow for managing Native changes in Comet, where requirements, progress, and acceptance results are saved in project files. It uses the Comet command-line runtime to move through defined work stages.
comet-build
A Comet workflow step for turning an approved design into an implementation plan and completed code changes. Comet is the project workflow system described by the add-on.
comet-classic
A Chinese-language workflow guide for starting or resuming a structured software change using OpenSpec and Superpowers.
comet-open
A guide for starting an OpenSpec change: a tracked software task with proposal, design, task, and state files. It also covers choosing or restoring the correct project workspace and output language.
comet-build
Comet Phase 3: Plan and Build. Invoke with /comet-build. Create plans and select execution method (subagent or direct) for implementation.
subagent-driven-development
Use when executing implementation plans with independent tasks in the current session.