A codebase stabilisation pass that runs the full test suite, fixes bugs, checks the software structure, and adds regression or missing-coverage tests. Regression tests check that previously fixed problems do not return.

Use it after implementation to find bugs, improve test coverage, and apply consistent spacing, typography, colours, icons, and state visuals across the codebase.

It addresses broken behaviour and inconsistent code without adding new interface elements or rearranging the existing interface. It also helps expose areas that are not tested.

auto-harden — Skill for Claude Code by Jerry0022/dotclaude

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add Jerry0022/dotclaude --skill auto-harden

Clone the repo

git clone --depth 1 https://github.com/Jerry0022/dotclaude

Made for: Claude Code.

Or install devops, the plugin that ships this one along with the rest of its 18 skills, 12 agents, 9 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/jerry0022/dotclaude/auto-harden/github.svg)](https://agentmods.dev/skills/jerry0022/dotclaude/auto-harden)

Your own site

<a href="https://agentmods.dev/skills/jerry0022/dotclaude/auto-harden"><img src="https://agentmods.dev/badge/skills/jerry0022/dotclaude/auto-harden/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/jerry0022/dotclaude/auto-harden"><img src="https://agentmods.dev/badge/skills/jerry0022/dotclaude/auto-harden.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 186 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 5,614 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00186	$0.05614
Opus 5.5	$0.00074	$0.02246
Sonnet 5.5	$0.00037	$0.01123
Haiku 4.5	$0.00019	$0.00561

Measured 11d ago against content hash de8ad0759a48, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

auto-harden scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (skill-text.test.js), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/devops/skills/auto-harden/SKILL.md · 412 lines

How it starts

The opening of the file, as written. The whole thing — 412 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Tune Harden — Stabilization Pass

Harden the codebase: tests, bugs, architecture, and consistency — without restructuring the UI. Scope: $ARGUMENTS.

Invocation Context

Callers sit ABOVE this skill in the call graph (layer 4 — spec docs/superpowers/specs/2026-09-24-skill-restructure-design.md § Call graph): the user, /do-run and /do-ship. /auto-agents (layer 5) never calls it — it is the layer this skill executes through. Four ways in:

Direct — user asks for it (trigger phrase; the skill is hidden from the slash menu). Full skill runs as documented below. Asks questions when $AUTONOMOUS=0.
From /do-run (after every implementation — no longer a question) — --invoked-by=do-run, a full pass scoped to the run's changes, executed through auto-agents (§ Execution). Under "Autonom" do-run adds --autonomous; under "Strikt" it adds --strict. The pre-PR-2 values --invoked-by=agents and --invoked-by=autonomous (the latter implies --autonomous) are read as do-run.
From /do-ship — --invoked-by=ship --base=<base> [--cwd=<path>] <files of the diff>. The ship path: static checks on the diff's added lines, mechanical fixes only, no agents, no browser, no card. See § Ship path.
Under strict — --strict (from do-run "Strikt" or /do-ship in strict mode): see Step 1 and Rules. On the ship path it means report-only.

When --invoked-by=do-run is set, the skill adjusts:

No qa-agent re-spawn if the parent already runs a qa wave/agent. Rely on the parent's qa result, request a focused re-test only after fixes.
No redteam re-spawn if the parent has a redteam wave planned. Skip Step 9 redteam, flag for parent's wave instead.
No permission priming assumed — parent handled it.
AskUserQuestion suppressed under --autonomous; otherwise the user is present ("Interaktiv") and plan + confirm stays as documented.

Execution — through auto-agents

The fixes of a full pass (Steps 5–8) run through /auto-agents, the single execution path: Skill("auto-agents", "--from=auto-harden --mode=<m> <fix list>") with --mode=background under --autonomous, else --mode=interactive. Read its result block (tier, done, open, needs-decision, ship) and ignore ship — this skill never ships; its caller does. open and needs-decision items feed Step 10. Inline shortcut: when your own tier check lands on Inline (one domain, ≤ ~5 files), apply the fixes yourself without loading auto-agents. The read-only helpers (scout scans, the qa and redteam reviewers, code-simplifier) stay direct Agent spawns — they implement nothing. The ship path never loads auto-agents.

Read the full file on GitHub · 412 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

skill-text.test.js 4.0 KB runs code

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago Changed de8ad0759a48
16d ago Changed · -6 lines 0a87eab292e5
1mo ago Changed · -27 lines 8eeecc6350f6
1mo ago Changed · +5 lines a59d1ddfb7db
1mo ago Changed 50880c0cefaf
1mo ago First seen · 440 lines · 186 tokens per session scan A ee8164e0f6e5

Subscribe to this mod's changes

auto-harden is a skill published in the GitHub repository Jerry0022/dotclaude (6 stars, last pushed 11d ago), licensed MIT. It adds 186 tokens to every session and 5,614 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-24.

Debugging Testing

auto-harden next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
auto-hardenJerry0022/dotclaude	Skill	6	11d ago	MIT	A	186	Claude Code
systematic-debuggingopen-metadata/OpenMetadata	Skill	16k	yesterday	Apache-2.0	A	37	Claude Code
log-error-digestzebbern/claude-code-guide	Skill	4.7k	3d ago	MIT	A	71	Claude Code, Codex
cwv-optimizeradobe/skills	Skill	319	yesterday	Apache-2.0	A	112	Claude Code
ci-fixersipyourdrink-ltd/bernstein	Skill	1.2k	yesterday	Apache-2.0	A	15	Claude Code, Codex
incident-response-incident-responsermyndharis/antigravity-skills	Skill	1.9k	23d ago	MIT	A	36	Claude Code
triaging-web-analytics-supportPostHog/posthog	Skill	41k	yesterday	none	A	151	Claude Code, Codex