Borrowing it
Nothing to install: this file belongs to mdesalvo/Morgana. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mdesalvo/Morgana/main/.claude/skills/harness-execution/SKILL.mdgit clone --depth 1 https://github.com/mdesalvo/MorganaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mdesalvo/morgana/harness-execution)<a href="https://agentmods.dev/skills/mdesalvo/morgana/harness-execution"><img src="https://agentmods.dev/badge/skills/mdesalvo/morgana/harness-execution.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.03364 |
| Opus 5 | $0.00029 | $0.01682 |
| Sonnet 5 | $0.00012 | $0.00673 |
| Haiku 4.5 | $0.00006 | $0.00336 |
Grade A, and why
harness-execution scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 189 lines — stays where its author put it; the contents beside it link to each section on GitHub.
HarnessExecution
Runs the PromptHarness (PromptHarness/PromptHarness.csproj) on demand against whichever LLM
provider is currently configured in User Secrets (Morgana:LLM:Provider), against a user-chosen
scope and a user-chosen global run/pass threshold. Live LLM calls, real cost — never runs without
the two questions below being answered first.
Trigger
Activated when the user says things like:
- "run the harness"
- "execute the prompt harness"
- "launch the harness"
- Any request to run PromptHarness scenarios against the current provider
Procedure
-
Confirm the active provider before anything else: read
Morgana:LLM:Providerfrom the shared User Secrets store (UserSecretsId 374228be-4f26-4382-a3ef-7500a0b829dd, same asMorgana.Web) without printing the ApiKey/Endpoint values and tell the user which provider/tier models (Tiers.Efficiency.Options.ModelId/Tiers.Performance.Options.ModelId) this run will hit. This is the harness's own design (PromptHarness/README.md): it never has its ownMorgana:config, it inherits the host's. The same file is whereHarness:HarnessDirectorylives when the user has overridden it (see step 7), so read both in one pass. Note the store is written with a UTF-8 BOM: parse it asutf-8-sig, or a plain JSON read fails on the first character. -
Ask the target scope with
AskUserQuestion, multi-select. EnumeratePromptHarness/Tests/first and offer what is actually there — the class list below is a description of a moving directory, not a contract, and a--filternaming a class that no longer exists runs zero tests and exits 0: a green nobody asked for. Thirteen classes at the time of writing, in four families:Deterministic — no model, no cost. Run them first: they are the cheapest way to learn the topology under test is sane before any billed turn.
- Startup validation (
StartupValidationTests— an incoherent partner declaration must stop the boot) - Agent card (
AgentCardTests— the published card and how far the gate behind it reaches) - Peer federation (
PeerFederationTests— the outbound half: which cards this side accepts, what it signs, where a credential may go)
- Startup validation (
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +38 lines 120f4d28aa4d
- yesterday Changed 9cb506cbab5d
- 3d ago Changed · +14 lines 946ce9535c94
- 8d ago First seen · 137 lines · 58 tokens per session scan A 8f6b47acad37
harness-execution is a skill published in the GitHub repository mdesalvo/Morgana (10 stars, last pushed today), licensed Apache-2.0. It adds 58 tokens to every session and 3,364 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
develop-web-game
Use when Codex is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script with short input bursts and intentional pauses, inspect screenshots/text, and review console errors with rendergametotext.
ui-craft-checks
Use this comprehensive gate for formal review, QA, launch handoff, exact-fidelity inspection, high-risk complex UI, or when the fast gate exposes a deeper craft problem. Ordinary single-screen work uses ui-design-executor and its bundled validator without loading this full matrix. Pair standalone artifacts with…
verify-implementation
A workflow that runs a project’s verification skills to produce a report on coding patterns, architecture rules, and project conventions. It is intended for work after implementation, before a pull request, or during code review.
red-team-review
Unified adversarial review: v4.3 Strategic Matrix (MTA-004). 7-phase framework: Priors → Rubric → Adversarial Lenses → SWOT/TOWS → MCDA Decision Engine → Blind Spot/Kill Switch → Executive Summary. Absorbs: bias-detector.
ha-test-strategy
Hope-native test strategy for features, fixes, and refactors: select test-first, regression-first, characterization, integration, E2E, or manual evidence according to risk and repository rules.
consiglieri-protocol
Mandatory pre-flight checklist for high-variance social contracts. Covers the Pryce Test, Exit Test, STFU Clause, Blast Radius Audit, Vibe Veto, and Adult-to-Adult comms rewrite.