Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/movebrickschi/harness-engineering-mcp/third-party-flownpx skills add movebrickschi/harness-engineering-mcp --skill third-party-flowgit clone --depth 1 https://github.com/movebrickschi/harness-engineering-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/movebrickschi/harness-engineering-mcp/third-party-flow)<a href="https://agentmods.dev/skills/movebrickschi/harness-engineering-mcp/third-party-flow"><img src="https://agentmods.dev/badge/skills/movebrickschi/harness-engineering-mcp/third-party-flow.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00101 | $0.01404 |
| Opus 5 | $0.00051 | $0.00702 |
| Sonnet 5 | $0.00020 | $0.00281 |
| Haiku 4.5 | $0.00010 | $0.00140 |
Grade A, and why
third-party-flow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
third-party-flow
适用场景
接入支付、IM、OAuth、短信、OSS、地图、AI Provider 等任意第三方服务/SDK。
前置条件
确认 _playbook.md Part B.3 启动参数；额外 vendor_name、vendor_doc_url、use_case（一句话描述用途）。
流程步骤
阶段 0 · 上下文初始化
move_agent_to_root；建知识库目录（极简 META.md）。
阶段 1 · 文档与契约调研
- 读官方文档；列出能力 / 限制 / 计费 / 配额 / 错误码
cursor-ide-browser打开 vendor 文档示例页面，必要时跑一遍其 demo- 输出
VENDOR_NOTES.md：能力清单、关键限制、错误码、SLA、计费模式
阶段 2 · 安全与合规检查
prompt: "本次接入是否涉及："
options:
- "用户敏感数据（身份证 / 手机号 / 支付 / 健康）"
- "Webhook 回调（vendor 反向推送给我们）"
- "需要存储 vendor 颁发的 token / refresh_token"
- "以上都不是"
allow_multiple: true
任一勾选 → 阶段 7 必做 /cso，且 IMPLEMENTATION_PLAN.md 必须含密钥管理与回调签名校验方案。
阶段 3 · 适配层方案 + 卡点
- 设计领域接口（
PaymentGateway、SmsSender等抽象） - vendor SDK 仅在适配层使用，应用层一律调领域接口
- 输出
IMPLEMENTATION_PLAN.md：适配层接口 + DTO 转换 + 错误映射 + 重试/超时策略 - 卡点：
prompt: "适配层方案如下：[一句话摘要]。请确认："
options:
- "方案 OK，进入实现"
- "需要修改方案（说明）"
- "需要先做更多 vendor 调研"
阶段 4 · 沙箱实现
- 用 vendor 的 sandbox / test mode 跑通最小路径
- 派
backend-agent（适配层）+test-agent（契约 + 错误码 + Webhook 签名） - commit：
feat(scope): 接入 [vendor] 沙箱
阶段 5 · 失败剧本演练
按 vendor 错误码列表，主动注入失败：网络超时 / 401 / 429 / 5xx / 签名错误 / 重复回调；
确认每种情况都有合理处理（重试 / 降级 / 告警）。输出 FAILURE_PLAYBOOK.md。
阶段 6 · 切到生产 vendor
- 切换密钥/endpoint
- 在预发跑一次最小金额/最小动作的真实调用
- 确认账单/日志/监控就位
阶段 7 · 自查
/cso（必做：密钥不入库、Webhook 签名校验、敏感字段日志脱敏）/qa+/review
阶段 8 · 上线
/ship → /land-and-deploy → /canary（重点监控 vendor 错误率、回调延迟）。
阶段 9 · 复盘
append _lessons.md：vendor 坑点 / 错误码处理模式 / 限流抗压数据。
错误处理
- vendor 文档与实际行为不符 → 在
VENDOR_NOTES.md标注，必要时联系 vendor 支持 - 沙箱与生产差异大 → 阶段 6 拉长真实调用验证窗口
- 密钥误提交到 git → 立即吊销 + 重发；按 _playbook.md Part B.5"事故应对"处理
产物清单
META.md、VENDOR_NOTES.md、IMPLEMENTATION_PLAN.md、适配层代码、FAILURE_PLAYBOOK.md、/cso 报告、PR 链接。
支持的修饰符
- M3 新项目 → 阶段 4 同时落地适配层模板，写入
ARCHITECTURE.md，便于未来同类 vendor 复用 - M4 数据库迁移（如要存储 vendor 数据/log）→ 必出
MIGRATION_PLAN.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 122 lines · 101 tokens per session scan A 33e4397ad3c6
third-party-flow is a skill published in the GitHub repository movebrickschi/harness-engineering-mcp (2 stars, last pushed 3mo ago), licensed MIT. It adds 101 tokens to every session and 1,404 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…