Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/junliu1066/vibe-coding-kit/vibe-coding-harnessnpx skills add Junliu1066/vibe-coding-kit --skill vibe-coding-harnessgit clone --depth 1 https://github.com/Junliu1066/vibe-coding-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/junliu1066/vibe-coding-kit/vibe-coding-harness)<a href="https://agentmods.dev/skills/junliu1066/vibe-coding-kit/vibe-coding-harness"><img src="https://agentmods.dev/badge/skills/junliu1066/vibe-coding-kit/vibe-coding-harness.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00171 | $0.02944 |
| Opus 5 | $0.00086 | $0.01472 |
| Sonnet 5 | $0.00034 | $0.00589 |
| Haiku 4.5 | $0.00017 | $0.00294 |
Grade A, and why
vibe-coding-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.
质检 Agent:产出物合规检查
这不是一个独立使用的 Skill,而是其他 Skill 的"守门员"——在任何 Skill 声称"完成"后,用它来验证产出物是否真正符合规范。
治理规则来自项目根目录的
harness.json(唯一真实来源)和CLAUDE.md(人类可读宪法)。 本 Skill 把这些规则变成逐条可执行的检查项。
检查流程
Step 1:确定检查范围
先确认用户想检查什么:
- 如果用户指定了 Skill(如"检查 PRD"),只检查那个 Skill 的产出
- 如果用户说"全量检查"或没说具体,检查
docs/下所有已有产出物 - 如果
docs/不存在或为空,直接报告"没有可检查的产出物"
Step 2:加载规则
读取项目根目录的 harness.json,提取:
- 目标 Skill 的
produces(该产出什么文件) - 目标 Skill 的
required_sections(必须包含的章节) - 目标 Skill 的
field_requirements(字段级校验规则) - 目标 Skill 的
validation(内容级校验规则) cross_skill_rules(跨 Skill 一致性规则,仅在多 Skill 产出共存时检查)quality_gates.before_delivery(交付前必须通过的门)workflow(流程定义:阶段、步骤、entry_gate/exit_gate、账本规则)—— 用于新增的流程一致性检查progress_cards(项目进度卡规则:低上下文读取、总表/模块卡/任务卡同步)
并读取 docs/进度账本.md(流程状态来源)。若不存在,流程检查记为"未启用账本"。
如果项目存在 .dsu/progress/index.md,读取该文件并按需抽查相关模块卡和任务卡;如果不存在,项目进度卡检查记为"未启用"。
Step 3:逐项检查
按以下顺序逐项检查,每项给出通过/不通过/不适用:
3.0 流程一致性检查(最先做 · 这一版新增)
对照 harness.json.workflow 和 docs/进度账本.md,核对过程有没有跑偏(不只是产出物对不对):
- 阶段按序:有没有跳过整个阶段而未推进(如账本显示在 S2,但 S1 出口门 ✗)。
- 假完成:账本标「已完成」的阶段,其
exit_gate是否真的过了(防止"账本说完成、产出物却没达标")。 - 跳步留痕:被跳过的步骤是否都是
required:false、且在账本"跳步留痕"写了理由;required:true的步骤被跳 = 🔴 违规。 - 账本与产出物吻合:账本当前阶段/步骤,与
docs/下实际存在的产出物对得上。 - 红线:若项目涉及"动钱 / 动别人隐私",survival 红线提示是否出现过。
输出:🔴 流程违规(如"S1 未过却已在 S2")/🟡 跳步未留痕、账本与进度说明书不一致/✅ 流程一致。
3.0.5 项目进度卡检查(开发期上下文治理)
如果项目启用了 .dsu/progress/,对照 harness.json.progress_cards 检查:
- 总表是否存在:
.dsu/progress/index.md是否存在且非空。 - 总表是否只放索引级信息:总表应只回答当前阶段、当前主线、完成 DU、进行中 DU、下一步、最大风险,不应堆模块实现细节。
- 读取规则是否清楚:总表必须说明默认只读 index,按需读取模块卡,复盘才读任务卡。
- 模块卡是否可下钻:DU 总进度表中的细节卡路径应指向
.dsu/progress/modules/duXX-xxx.md。 - 任务 closeout 是否同步:最近任务更新后,应能在任务卡、模块卡、总表三处看到一致状态。
- 状态枚举是否合规:只能使用 未开始 / 脚手架 / 进行中 / 已完成 / 阻塞 / 回滚 / 待重构。
- 最小上下文是否可用:总表中的「下一轮 AI 最小上下文」应控制在 150 到 300 字,且不写历史流水账。
输出:🔴 缺少总表或状态冲突/🟡 总表过细、模块卡缺失、任务 closeout 未同步/✅ 项目进度卡可用。
3.1 文件存在检查
对照 produces,确认每个文件是否已创建、是否非空。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 216 lines · 171 tokens per session scan A fc738fbdcc1b
vibe-coding-harness is a skill published in the GitHub repository Junliu1066/vibe-coding-kit (169 stars, last pushed 2mo ago), licensed MIT. It adds 171 tokens to every session and 2,944 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
automation-flows
Use when building or fixing a no-code automation on n8n, Make, or Zapier — trigger to multi-app steps with data mapping, dedup, retries and an error path — or picking the platform by billing unit (task vs credit vs execution). NOT a typed API client in code (that is api-connector-builder), NOT a webhook receiver in…
ai-delivery-spec
Use for creating, changing, reviewing, reverse-engineering or accepting requirements, PRDs, prototypes, competitor material or existing systems, including any small UI, field, column, tab, dropdown or legacy-HTML change. Supports /ads, /dig, /prd and /proto intent shortcuts where the host routes them. Always invoke…
mvp-build-tickets
Generate implementation task tickets for a Web MVP. Use after AGENTS.md and agentdocs exist when the user needs small Codex-executable task files with required reading, scope, acceptance criteria, implementation plan, verification checks, risks, and done conditions.
mvp-agent-context
Generate Codex-first agent context files for a Web MVP. Use after the PRD and Technical Blueprint exist when the user needs AGENTS.md, REVIEW-CHECKLIST.md, and agentdocs for project brief, requirements, tech stack, page map, data model, build tasks, testing, and reusable prompts.
mvp-workflow
Orchestrate a Codex-first Web MVP planning workflow from rough idea to build-ready artifacts. Use when the user wants to turn an app idea into a structured MVP plan, PRD, technical blueprint, AGENTS.md context, and implementation tickets.
mvp-idea-brief
Create an Idea Brief for a Web MVP. Use when the user has a rough app idea and needs to clarify the target user, problem, current workaround, smallest useful outcome, platform choice, budget, and MVP exclusions before research or PRD work.