Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jscraik/Agent-Skills --skill coding-harnessgit clone --depth 1 https://github.com/jscraik/Agent-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jscraik/agent-skills/coding-harness)<a href="https://agentmods.dev/skills/jscraik/agent-skills/coding-harness"><img src="https://agentmods.dev/badge/skills/jscraik/agent-skills/coding-harness/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jscraik/agent-skills/coding-harness"><img src="https://agentmods.dev/badge/skills/jscraik/agent-skills/coding-harness.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01986 |
| Opus 5 | $0.00027 | $0.00993 |
| Sonnet 5 | $0.00011 | $0.00397 |
| Haiku 4.5 | $0.00005 | $0.00199 |
Grade A, and why
coding-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Coding Harness
Operate @brainwav/coding-harness with command-accurate, preview-first validation.
Philosophy
- Start from live command/source evidence and local repository patterns.
- Keep setup and repair reversible: dry-run before mutation, then validate.
- Do not remove important context for budget trimming; route details through references.
- Separate local scaffold truth from auth-bound remote checks.
When To Use
- A repo needs harness install, bootstrap, upgrade, repair, or explanation.
- The user asks about harness command discovery, CI migration, governance checks, or action sync.
- Harness state needs live command evidence before being called green.
- A downstream skill or repo-local projection needs to match the current
coding-harnesssource shape.
Avoid
- Unrelated feature work or generic deployment.
- Claims that remote checks passed without credentials and command output.
- Overwriting user-owned files outside harness-managed scaffolds.
- Reporting full capabilities from focused help output.
Inputs
- repo path
- package manager
- current harness state
- execution mode
- validation depth
- auth posture
Outputs
- setup/remediation summary
- commands run
- file changes
- validation ladder
- blockers and residual risks
- Schema-bound outputs include
schema_version.
Current Command Shape
- Fresh-agent entrypoint:
harness next --json. - Focused first-contact help:
harness --help; it intentionally exposes the cockpit rail first. - Public agent rail catalog:
harness commands --json --for-agent. - Full expert catalog:
harness commands --jsonorharness --help --all-commands. - In the
coding-harnesssource repo, prefer source probes such aspnpm exec tsx src/cli.ts next --jsonover a globally installed binary. - In consumer repos, prefer the installed
harnessbinary, commonly installed withmise install -g npm:@brainwav/coding-harness.
Current Project Contracts
- Routine existing-repo updates use
harness upgrade --dry-runthenharness upgrade. - Use
harness init --updateonly for deliberate re-scaffolding of tracked baseline files. - CI migration is snapshot-backed: use
harness ci-migrate prepare,verify,commit, andabort; do not manually delete.github/workflows/. - CircleCI owns the primary PR gate; CodeRabbit is the independent review check; Semgrep Cloud is the independent external security check; GitHub Actions is release/fallback only unless intentionally migrated.
.codex/environments/environment.tomlis generated from canonical action blocks and project scripts; only auto-update it when it is harness-autogenerated or explicitly approved.- Per-repo learned fixes live in
.harness/memory/LEARNINGS.mdwhen the target repo already uses.harness/.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 147 lines · 54 tokens per session scan A 66bd3a408e65
coding-harness is a skill published in the GitHub repository jscraik/Agent-Skills (8 stars, last pushed 10d ago), licensed Apache-2.0. It adds 54 tokens to every session and 1,986 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
ci-cd-pipeline
CI/CD pipeline design and implementation for GitHub Actions, Azure DevOps, and general pipeline architecture. Use when creating build pipelines, deployment workflows, quality gates, environment promotion strategies, or automating release processes.
deploy-local
End-to-end local deployment loop for Gitea-hosted projects. Use when the user wants to commit on dev, push to remote, monitor the golden CI/build/deploy workflow, validate prod on the configured prod host, and fix lint/test/pipeline failures until deployment is healthy.
monorepo
Monorepo management with Turborepo and pnpm workspaces. Use for Turborepo setup, turbo.json task dependencies, remote caching, pnpm workspace protocol, shared packages (ui-library, config, types), affected-only CI/CD builds, or monorepo structure (apps/ vs packages/). Covers pitfalls like circular deps, version drift…
CI/CD Pipeline Config
CI/CD pipeline configuration skill for test automation, covering GitHub Actions, Jenkins, GitLab CI, test parallelization, reporting, and artifact management.
integration-binding
Connect a task to MCP tools, workflows, resources, files, or visual outputs through explicit validated interfaces.
dxkit-pr
Open a pull request with a title + body grounded in the branch's real commits and diff — what changed, features implemented, findings fixed — plus a reviewer checklist and the dxkit guardrail/allowlist/score signals a reviewer needs. Use when the user says "raise a PR", "open a pull request", "create the PR", "write…