Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add easyinplay/harnessed --skill preflightgit clone --depth 1 https://github.com/easyinplay/harnessedWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/easyinplay/harnessed/preflight)<a href="https://agentmods.dev/skills/easyinplay/harnessed/preflight"><img src="https://agentmods.dev/badge/skills/easyinplay/harnessed/preflight/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/easyinplay/harnessed/preflight"><img src="https://agentmods.dev/badge/skills/easyinplay/harnessed/preflight.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.01127 |
| Opus 5.5 | $0.00025 | $0.00451 |
| Sonnet 5.5 | $0.00012 | $0.00225 |
| Haiku 4.5 | $0.00006 | $0.00113 |
Grade A, and why
ship-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ship-preflight (Stage ⑤.a)
Overview
The machine-checkable "PR ready != release ready" gate. Runs the harnessed-native
harnessed release-preflight command, which inspects (read-only) whether the repo is
ready to tag a release:
| check | passes when |
|---|---|
changelog |
## [Unreleased] has entries (this release is documented) |
version |
package.json has a valid semver |
git-clean |
the working tree has no uncommitted changes |
tag-absent |
a v<version> tag does NOT already exist |
Process
- Run
harnessed release-preflight. - If any check fails, STOP — surface the
fix:hints and do not proceed to PR/tag.- Empty
[Unreleased]is the most common failure: document the release first.
- Empty
- If all pass, the repo is tag-ready. The ship master continues to PR/deploy.
Boundary
This gate is READ-ONLY. It never pushes, publishes, or creates a tag. The actual
npm publish + GitHub release happen in publish.yml CI when a v<version> tag is
pushed (with explicit user approval).
How to invoke
!harnessed checkpoint intent ship-preflight
The banner above (when present) means this invocation is REGISTERED with the engine (an intent marker) — not yet compliant: the steps below (prompt → spawn → checkpoint complete) resolve it, and a per-turn
<workflow-intent>reminder persists until they run.
The numbered sequence below is the state machine — execute it with Bash. Do NOT improvise an equivalent flow from the Overview above: freelancing bypasses the engine (no ledger, no evidence guard). harnessed gives you the spawn-ready prompt; YOU spawn the subagent with a {{ host.native }} {{ host.spawn_subagent }} (keeps the session responsive + lets clarification round-trips reach the user).
Do NOT pipe to harnessed run ship-preflight — that is the CI/headless path ({{ host.harnessed_run_warning_note.execution_tail }}
- Bash:
harnessed prompt ship-preflight --task "$ARGUMENTS" --json→ parse{prompt, max_iterations, model}. - Spawn a {{ host.native }} subagent ({{ host.spawn_subagent }}) with that
promptandmodel, then drive delivery with harnessed's own completion gate:- on return, write the subagent's final output to a file and run
harnessed checkpoint complete ship-preflight --result-file <path>— it is fail-closed on the declared artifacts, the TDD boundary, and the verbatim<promise>COMPLETE</promise>. - if it blocks, run
harnessed checkpoint fail ship-preflight --failing-tests <n>to record the attempt; it prints BUDGET-EXHAUSTED / NO-PROGRESS / BREAK-LOOP when a stop condition is reached. - respawn ONLY while none of those three has fired. Any one of them means stop: re-scope the subtask, fix the blocker, or escalate to the user. Never respawn past a stop directive.
- on return, write the subagent's final output to a file and run
- If the output contains
STATUS: NEEDS_CLARIFICATION+ a question list: STOP, relay them verbatim via {{ host.ask_user }}, append the answers to the spec, then re-spawn the same sub. - On
<promise>COMPLETE</promise>: write the subagent’s final output to a file, then Bashharnessed checkpoint complete ship-preflight --result-file <path> --summary "<one-line>". Fail-CLOSED — it blocks unless every declaredartifacts_expectedfile exists, the TDD boundary passes (non-empty evidence / both the red and green sides present / the test file was not deleted), and the result carries a verbatim<promise>COMPLETE</promise>(or a structured COMPLETE status).--result <text>is the inline variant;--result-filewins and is quoting-safe on Windows.--forcerecords an audited override (evidence_status=overridden) — it does not silently pass. - If the complete gate blocked: Bash
harnessed checkpoint fail ship-preflight --failing-tests <n>to record the attempt. It printsBUDGET-EXHAUSTED/NO-PROGRESS/BREAK-LOOPonce a stop condition is reached. Respawn ONLY while none of those three has fired; any one of them means STOP — re-scope the subtask, fix the blocker, or escalate to the user.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · -1 lines eee0a0255b66
- 1mo ago First seen · 66 lines · 62 tokens per session scan A 45768d8efd29
ship-preflight is a skill published in the GitHub repository easyinplay/harnessed (2 stars, last pushed 3d ago), licensed Apache-2.0. It adds 62 tokens to every session and 1,127 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
release
CONTRIBUTOR TOOL - Cut a plugin release: bump plugin.json version, finalize CHANGELOG, update README if needed, gate on make ci, commit, tag vX.Y.Z, and create the GitHub release. Use when shipping a new plugin version. NOT distributed.
create-release-checklist
Create a release checklist and GitHub issue for an R package. Use when the user asks to "create a release checklist" or "start a release" for an R package.
han-release
Cut a Han release: update CHANGELOG.md with the changes since the last release, bump and tag every plugin that changed as {plugin-name}--v{version} so a version-constrained dependency can resolve, and publish a GitHub release crediting every merged pull request and closed issue to the people behind it. Use when…
push-ci
Push to remote and monitor CI. Validates branch safety, executes git push WITH explicit user approval, then monitors CI run status via gh CLI. Use when: user says 'push', 'push and watch CI', 'ship it', 'push-ci'. Not for: committing (use /smart-commit), creating PRs (use /create-pr), merging (use /merge-prep).
bump-version
A procedure for changing a package and plugin version in several project files at the same time.
update
Safe cc10x upgrade through the Claude Code plugin CLI. Lists every installed scope, refreshes the marketplace, updates each scope, and optionally carries local patches over to the new install. Use this skill when: updating cc10x, upgrading, pulling latest cc10x, syncing plugin, refreshing cache, or checking for new…