Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/easyinplay/harnessed/preflightnpx skills add easyinplay/harnessed --skill preflightgit clone --depth 1 https://github.com/easyinplay/harnessedWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/easyinplay/harnessed/preflight)<a href="https://agentmods.dev/skills/easyinplay/harnessed/preflight"><img src="https://agentmods.dev/badge/skills/easyinplay/harnessed/preflight.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.01119 |
| Opus 5 | $0.00031 | $0.00560 |
| Sonnet 5 | $0.00012 | $0.00224 |
| Haiku 4.5 | $0.00006 | $0.00112 |
Grade A, and why
ship-preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ship-preflight (Stage ⑤.a)
Overview
The machine-checkable "PR ready != release ready" gate. Runs the harnessed-native
harnessed release-preflight command, which inspects (read-only) whether the repo is
ready to tag a release:
| check | passes when |
|---|---|
changelog |
## [Unreleased] has entries (this release is documented) |
version |
package.json has a valid semver |
git-clean |
the working tree has no uncommitted changes |
tag-absent |
a v<version> tag does NOT already exist |
Process
- Run
harnessed release-preflight. - If any check fails, STOP — surface the
fix:hints and do not proceed to PR/tag.- Empty
[Unreleased]is the most common failure: document the release first.
- Empty
- If all pass, the repo is tag-ready. The ship master continues to PR/deploy.
Boundary
This gate is READ-ONLY. It never pushes, publishes, or creates a tag. The actual
npm publish + GitHub release happen in publish.yml CI when a v<version> tag is
pushed (with explicit user approval).
How to invoke
!harnessed checkpoint intent ship-preflight
The banner above (when present) means this invocation is REGISTERED with the engine (an intent marker) — not yet compliant: the steps below (prompt → spawn → checkpoint complete) resolve it, and a per-turn
<workflow-intent>reminder persists until they run.
The numbered sequence below is the state machine — execute it with Bash. Do NOT improvise an equivalent flow from the Overview above: freelancing bypasses the engine (no ledger, no evidence guard). harnessed gives you the spawn-ready prompt; YOU spawn the subagent with a CC-native Task / Agent tool (keeps the session responsive + lets clarification round-trips reach the user).
Do NOT pipe to harnessed run ship-preflight — that is the CI/headless path (in-process SDK spawn
that blocks the session inside Claude Code).
- Bash:
harnessed prompt ship-preflight --task "$ARGUMENTS" --json→ parse{prompt, max_iterations, model}. - Spawn a CC-native subagent (Task / Agent tool) with that
promptandmodel, then drive delivery with harnessed's own completion gate:- on return, write the subagent's final output to a file and run
harnessed checkpoint complete ship-preflight --result-file <path>— it is fail-closed on the declared artifacts, the TDD boundary, and the verbatim<promise>COMPLETE</promise>. - if it blocks, run
harnessed checkpoint fail ship-preflight --failing-tests <n>to record the attempt; it prints BUDGET-EXHAUSTED / NO-PROGRESS / BREAK-LOOP when a stop condition is reached. - respawn ONLY while none of those three has fired. Any one of them means stop: re-scope the subtask, fix the blocker, or escalate to the user. Never respawn past a stop directive.
- on return, write the subagent's final output to a file and run
- If the output contains
STATUS: NEEDS_CLARIFICATION+ a question list: STOP, relay them verbatim via AskUserQuestion, append the answers to the spec, then re-spawn the same sub. - On
<promise>COMPLETE</promise>: write the subagent’s final output to a file, then Bashharnessed checkpoint complete ship-preflight --result-file <path> --summary "<one-line>". Fail-CLOSED — it blocks unless every declaredartifacts_expectedfile exists, the TDD boundary passes (non-empty evidence / both the red and green sides present / the test file was not deleted), and the result carries a verbatim<promise>COMPLETE</promise>(or a structured COMPLETE status).--result <text>is the inline variant;--result-filewins and is quoting-safe on Windows.--forcerecords an audited override (evidence_status=overridden) — it does not silently pass. - If the complete gate blocked: Bash
harnessed checkpoint fail ship-preflight --failing-tests <n>to record the attempt. It printsBUDGET-EXHAUSTED/NO-PROGRESS/BREAK-LOOPonce a stop condition is reached. Respawn ONLY while none of those three has fired; any one of them means STOP — re-scope the subtask, fix the blocker, or escalate to the user.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 66 lines · 62 tokens per session scan A 45768d8efd29
ship-preflight is a skill published in the GitHub repository easyinplay/harnessed (2 stars, last pushed 8d ago), licensed Apache-2.0. It adds 62 tokens to every session and 1,119 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
release
Release a new version of the mumei repository. Invoke when the user gives an explicit release instruction ("release it", "/release", "patch release", "ship 0.2.0"). Takes no argument or "patch" / "minor" / "major" for a SemVer bump, or a direct version such as "0.2.0". Wraps any uncommitted changes into a single…
update
Safe cc10x upgrade that preserves local modifications. Stashes diffs, pulls upstream, rebuilds cache, rebases patches. Use this skill when: updating cc10x, upgrading, pulling latest cc10x, syncing plugin, refreshing cache, or checking for new versions. Triggers: update cc10x, upgrade cc10x, pull cc10x, sync plugin…
dev:release
Use when the user wants to release a new version, publish to npm, create a GitHub release, bump version, or tag a release. Also use when the user says 'release', 'publish', 'bump version', 'tag', or 'npm publish'.
harness:deploy
Use when the user is done evolving and wants to finalize, clean up, tag the result, or push the optimized agent.
push-ci
Push to remote and monitor CI. Validates branch safety, executes git push WITH explicit user approval, then monitors CI run status via gh CLI. Use when: user says 'push', 'push and watch CI', 'ship it', 'push-ci'. Not for: committing (use /smart-commit), creating PRs (use /create-pr), merging (use /merge-prep).
harness
하네스를 구성합니다. 전문 에이전트를 정의하며, 해당 에이전트가 사용할 스킬을 생성하는 메타 스킬. (1) '하네스 구성해줘', '하네스 구축해줘' 요청 시, (2) '하네스 설계', '하네스 엔지니어링' 요청 시, (3) 새로운 도메인/프로젝트에 대한 하네스 기반 자동화 체계를 구축할 때, (4) 하네스 구성을 재구성하거나 확장할 때, (5) '하네스 점검', '하네스 감사', '하네스 현황', '에이전트/스킬 동기화' 등 기존 하네스 운영/유지보수 요청 시 사용.