Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/harnessprotocol/harness-kit/harness-importnpx skills add harnessprotocol/harness-kit --skill harness-importgit clone --depth 1 https://github.com/harnessprotocol/harness-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/harnessprotocol/harness-kit/harness-import)<a href="https://agentmods.dev/skills/harnessprotocol/harness-kit/harness-import"><img src="https://agentmods.dev/badge/skills/harnessprotocol/harness-kit/harness-import.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00072 | $0.04231 |
| Opus 5 | $0.00036 | $0.02116 |
| Sonnet 5 | $0.00014 | $0.00846 |
| Haiku 4.5 | $0.00007 | $0.00423 |
Grade D, and why
harness-import scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
> curl -fsSL https://raw.githubusercontent.com/harnessprotocol/harness-kit/main/harness-restore.sh | bash -s -- harness.yaml Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- Codex or Windsurf confirmed: **skip** — neither has a project-level MCP file (Codex uses `~/.codex/config.toml`, Windsurf uses a global `~/.codeium/windsurf/mcp_config.json`). Print the same warning the compiler uses r Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
> curl -fsSL https://raw.githubusercontent.com/harnessprotocol/harness-kit/main/harness-restore.sh | bash -s -- harness.yaml How it starts
The opening of the file, as written. The whole thing — 358 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Import a Harness Configuration
You are helping the user install plugins from a harness.yaml file — either all of them or a subset they choose.
This skill handles both format versions:
- v1 protocol format (
version: "1"string) — usessource: owner/repoper plugin, may includemcp-servers,env, andinstructionssections - Legacy format (
version: 1integer) — usesmarketplace: keyper plugin with amarketplaces:section
Workflow Order (MANDATORY)
Follow these steps in order. Do not skip any step.
Step 1: Find and read the config
Check for harness.yaml in this order:
- A path provided by the user after
/harness-import(e.g.,/harness-import ~/dotfiles/harness.yaml) ./harness.yamlin the current directory
If no file is found at either location, tell the user:
"No
harness.yamlfound. Get one from a teammate or generate your own with/harness-export."
Read and parse the file. Detect which format version it uses:
version: "1"(string) → Protocol v1 formatversion: 1(integer) → Legacy format
Step 2: Show what's available
Display the plugin list clearly before asking anything:
Plugins in this config:
1. explain (harnessprotocol/harness-kit) — Layered explanations of files, functions, directories, or concepts
2. research (harnessprotocol/harness-kit) — Process any source into a structured, compounding knowledge base
3. superpowers (obra/superpowers-marketplace) — Structured dev workflows — TDD, systematic debugging, subagent delegation
For legacy format, resolve the source by looking up plugins[].marketplace → marketplaces[key].
Then, if the file contains any of the following sections, mention them briefly:
mcp-servers:— "This config also declares MCP servers. I'll ask about those after plugins."env:— "This config declares environment variables. I'll surface those after plugins."instructions:— "This config includes harness instructions. I'll offer to apply those after plugins."
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 358 lines · 0 tokens per session scan D e797b3c5b6c8
harness-import is a skill published in the GitHub repository harnessprotocol/harness-kit (10 stars, last pushed 4d ago), licensed Apache-2.0. It adds 72 tokens to every session and 4,231 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it D with 3 findings (downloads and executes remote code, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
studio
Architecture Studio control plane — initialize or inspect a studio workspace, create and register projects, or route an architecture/AEC task to the right agent or skill. Use when the user runs /as:studio, asks to set up or open their studio, manage its projects, or describes a task without naming a skill.
epd-to-spec
Write CSI specification language for EPD submittals and sourced GWP limits. Use to add embodied-carbon or EPD requirements to specs; not to parse, find, or compare EPDs.
occupancy-calculator
Calculate code occupant loads by area with gross/net factors and jurisdiction checks. Use for "how many people can this space hold," IBC Table 1004.5, egress inputs, or occupancy-load reports; not for workplace headcount planning.
zoning-analysis-nyc
Analyze NYC lot zoning, FAR, height, setbacks, uses, and buildable envelope from PLUTO and the Zoning Resolution. Use for "what can I build"; use nyc-bsa for relief and zoning-envelope for 3D visualization.
workplace-programmer
Build office space programs through guided workplace strategy: area splits, room schedules, and planned seat counts. Use to program or size a workplace; not for code occupant-load calculations.
workplan
Create a durable, execution-ready work plan for repository changes, operations, research, or AEC project delivery. Use when the user asks to plan, scope, sequence, coordinate, or break down multi-step work before acting. Do not use for floor plans, site plans, space planning, zoning calculations, building-code…