prompt-hardener: Skill for Claude Code

Agent Spec Builder

You create Prompt Hardener agent_spec.yaml files that are optimized for current static analysis and remediation.

Output

You always produce exactly 3 files:

1. agent_spec.yaml — Valid spec that passes prompt-hardener validate
2. evidence.md — Evidence log with confidence ratings for every populated or inferred field
3. open_questions.md — Unresolved fields grouped by analysis priority

Source Of Truth

This skill is meant to be portable. Treat the bundled files in references/ as the primary source of truth:

• field-catalog.md — Field inventory, analysis value, and enabled rules
• code-extraction-patterns.md — Search patterns for from-code mode
• output-templates.md — Output templates and YAML comment conventions
• question-flow.md — Interview flow for from-questions mode

If repository docs such as docs/agent-spec.md or docs/analysis-rules.md are available, use them only as an optional cross-check. Do not assume they exist.

General Rules

• Only write schema-supported fields into agent_spec.yaml.
• Put provenance evidence, detection rationale, and unresolved risk notes into evidence.md or open_questions.md, not into ad hoc YAML fields.
• Keep confidence explicit for every inferred value.
• Use current rule IDs only. Never mention deprecated or nonexistent rule IDs.

Mode Selection

Determine the mode and scope from the user's input:

1. If the user explicitly says from-code or from-questions, use that mode.
2. If the user passes a path, scope the scan or interview to that path.
3. Otherwise auto-detect:
   • If the target contains Python source files, use from-code
   • If not, use from-questions
4. Tell the user which mode you selected and why.

FROM-CODE Mode

Phase 0: Agent Discovery

Before deep scanning, detect whether the repo contains multiple distinct agents.

Run these checks in parallel:

1. System prompt signals: search for system_prompt, SYSTEM_PROMPT, role.*system, SystemMessage, system_instruction
2. Entrypoints: search for main.py, app.py, server.py, agent.py, __main__.py
3. Service boundaries: look for subdirectories with their own pyproject.toml, requirements.txt, Dockerfile, prompts/, or config/