Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mifunedev/openharness/cloudflarednpx skills add mifunedev/openharness --skill cloudflaredgit clone --depth 1 https://github.com/mifunedev/openharnessWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00095 | $0.01711 |
| Opus 5 | $0.00048 | $0.00856 |
| Sonnet 5 | $0.00019 | $0.00342 |
| Haiku 4.5 | $0.00010 | $0.00171 |
Grade A, and why
cloudflared scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
script's local `curl` precheck is necessary but NOT sufficient: an origin can How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloudflared
Use Cloudflared as the default public tunnel for sandbox app previews. Prefer a Cloudflare quick tunnel for temporary sharing; use a named tunnel only when the operator explicitly needs a stable hostname or Cloudflare Access policy.
Arguments
Arguments received: $ARGUMENTS
PORT: first positional argument; required (example:3000)--host: local upstream host; default127.0.0.1--name: optional slug for the tmux/log suffix; default is the port--session: optional tmux session name override; defaultcloudflared-<slug>
If PORT is missing, ask which local port to tunnel.
Pre-flight — confirm the public surface (do NOT assume)
A dev stack usually listens on several ports where only ONE is the intended
public surface (e.g. a web UI on :3005, a browser-editor gateway on :8788, a
metrics port, a DB). Picking the wrong one wastes a tunnel and can expose the
wrong service.
Before starting a tunnel:
- If the caller did not name the service explicitly, list the listening ports
and ask which service is meant to be public — never default to "the web
port".
ss -ltnpor the project's dev docs disambiguate. - A quick-tunnel URL is a public bearer URL — anyone with it reaches the origin. If the target is not a throwaway static preview (it has auth, webhooks, an admin surface, or real data), get an explicit go-ahead before exposing it.
Quick tunnel flow
Run inside the sandbox, after the app is already listening locally:
bash "$CLAUDE_SKILL_DIR/scripts/run.sh" $ARGUMENTS
The script verifies cloudflared, tmux, and the local upstream, starts a
Cloudflare quick tunnel in tmux, waits for the generated URL, and prints
inspect/log/stop commands.
Always verify through the PUBLIC url, not just the local upstream. The
script's local curl precheck is necessary but NOT sufficient: an origin can
answer 127.0.0.1 fine yet return 404/421 through the tunnel because it
routes on (or rejects) the Host header the tunnel sends (see Troubleshooting).
After the URL appears:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 157 lines · 95 tokens per session scan A 9ec1afc1cacd
cloudflared is a skill published in the GitHub repository mifunedev/openharness (36 stars, last pushed 2d ago), licensed Apache-2.0. It adds 95 tokens to every session and 1,711 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vercel-sandbox
Run agent-browser + Chrome inside Vercel Sandbox microVMs for browser automation from any Vercel-deployed app. Use when the user needs browser automation in a Vercel app (Next.js, SvelteKit, Nuxt, Remix, Astro, etc.), wants to run headless Chrome without binary size limits, needs persistent browser sessions across…
protected-vercel-deployments
Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection with agent-browser. Use when a preview or production URL redirects to a Vercel login page, returns a protection 401 or 403, or needs short-lived Trusted Sources OIDC authentication instead of a static bypass secret or…
cuml-machine-learning
Use for GPU-accelerated machine learning on tabular data using NVIDIA cuML. Triggers when tasks involve classification, regression, clustering, dimensionality reduction, or model training on datasets.
blog-post
Writes and structures long-form blog posts, creates tutorial outlines, and optimizes content for SEO with cover image generation. Use when the user asks to write a blog post, article, how-to guide, tutorial, technical writeup, thought leadership piece, or long-form content.
social-media
Drafts engaging social media posts, writes hooks, suggests hashtags, creates thread structures, and generates companion images. Use when the user asks to write a LinkedIn post, tweet, Twitter/X thread, social media caption, social post, or repurpose content for social platforms.
remember
Review the current conversation and capture valuable knowledge — best practices, coding conventions, architecture decisions, workflows, and user feedback — into persistent memory (AGENTS.md) or reusable skills. Use when the user says: (1) remember this, (2) save what we learned, (3) update memory, (4) capture…