Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nnabuuu/harness-engineering-toolkit --skill harness-auditgit clone --depth 1 https://github.com/nnabuuu/harness-engineering-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nnabuuu/harness-engineering-toolkit/harness-audit)<a href="https://agentmods.dev/skills/nnabuuu/harness-engineering-toolkit/harness-audit"><img src="https://agentmods.dev/badge/skills/nnabuuu/harness-engineering-toolkit/harness-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.03422 |
| Opus 5 | $0.00044 | $0.01711 |
| Sonnet 5 | $0.00017 | $0.00684 |
| Haiku 4.5 | $0.00009 | $0.00342 |
Grade A, and why
harness-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 337 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Harness Audit
Automatically scan a codebase for the five most common harness self-deceptions. For each one found, explain what's wrong, why it matters, and offer to fix it.
Framework: Five Self-Deceptions
| # | Self-Deception | What you think | What's actually true | Layer |
|---|---|---|---|---|
| 1 | The Stale Goal | "I have a goal" | Your goal doc is months old and doesn't match what you're building | L1 |
| 2 | The Monolith | "I have instructions" | Everything is in one file with no priority structure | L2 |
| 3 | The Paper Rule | "I have checks" | Your checks are generic defaults, not project-specific constraints | L3 |
| 4 | The Gut Review | "I review everything" | No systematic quality criteria; review quality varies by how busy you are | L4 |
| 5 | The Frozen Harness | "I set up my harness" | Nothing harness-related has changed in 30+ days | L4 |
Audit Procedure
Step 1: Identify Domain & Gather Data
Determine project type. Load domain-specific reference if available:
- Software engineering → read
docs/software-engineering.mdfor additional checks - Other domains → use generic checks below
Run all data gathering commands. Store results — you'll reference them in the diagnosis.
# === Goal documents ===
# Check for goal/spec/PRD files
find docs/ -maxdepth 2 \( -name "PRD*" -o -name "spec*" -o -name "requirements*" -o -name "features*" \) 2>/dev/null
ls README.md docs/PRD.md docs/product-spec.md docs/requirements.md docs/features.md docs/decisions/*.md 2>/dev/null
# Check if instruction file references goal documents
grep -i -E "(goal|objective|spec|prd|requirement|feature|docs/)" CLAUDE.md .cursorrules 2>/dev/null
# Goal freshness: last modified date vs project activity
stat -c '%Y' docs/PRD.md docs/requirements.md docs/features.md 2>/dev/null
git log -1 --format='%at' 2>/dev/null
# === Instruction files ===
# Line count of main instruction file
wc -l CLAUDE.md .cursorrules .github/copilot-instructions.md AGENTS.md 2>/dev/null
# Check for progressive disclosure (links to other docs)
grep -c "\[.*\](.*\.md)" CLAUDE.md 2>/dev/null
grep -c "see \|refer to \|详见\|参考" CLAUDE.md 2>/dev/null
# Check for package/module-level instruction files
find . -name "CLAUDE.md" -not -path "./CLAUDE.md" -not -path "*/node_modules/*" 2>/dev/null
# Count "must/never/always" rules vs total rules
grep -c -i -E "must|never|always|绝对|必须|不得" CLAUDE.md 2>/dev/null
grep -c "^-\|^[0-9]\." CLAUDE.md 2>/dev/null
# === Automated checks ===
# CI/CD
ls .github/workflows/*.yml .gitlab-ci.yml 2>/dev/null
# Pre-commit hooks
ls .husky/pre-commit .git/hooks/pre-commit 2>/dev/null
cat .husky/pre-commit 2>/dev/null
# Custom check scripts (project-specific, not framework defaults)
find scripts/ -name "*harness*" -o -name "*check*" -o -name "*lint*" 2>/dev/null
find . -name "*.arch.*" -o -name "*architecture*test*" -not -path "*/node_modules/*" 2>/dev/null | head -5
# Count custom rules vs framework defaults
# (Read CI config to see if there are project-specific checks beyond standard lint/typecheck)
# === Quality signals ===
ls docs/QUALITY_SCORE.md 2>/dev/null
ls jest.config.* vitest.config.* coverage/ 2>/dev/null
# === Harness evolution ===
# Harness-related commits in last 30 days
git log --since="30 days ago" --oneline -- \
CLAUDE.md .cursorrules AGENTS.md docs/ scripts/harness-checks.sh \
.eslintrc* commitlint.config.* .husky/ 2>/dev/null | wc -l
# Total commits for context
echo "Total commits (30d):"
git log --since="30 days ago" --oneline 2>/dev/null | wc -l
# Last modified date of instruction file
git log -1 --format='%ar' -- CLAUDE.md 2>/dev/null
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 337 lines · 87 tokens per session scan A 83e47613ee03
harness-audit is a skill published in the GitHub repository nnabuuu/harness-engineering-toolkit (5 stars, last pushed 1mo ago), licensed MIT. It adds 87 tokens to every session and 3,422 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
opencli-autofix
Automatically fix broken OpenCLI adapters when commands fail. Load this skill when an opencli command fails — it guides you through collecting a trace artifact, patching the adapter, retrying, and filing an upstream GitHub issue after a verified fix. Works with any AI agent.
RootCauseAnalysis
Structured incident investigation using Five Whys, Fishbone, blameless Postmortem, Fault Tree, Kepner-Tregoe, and FMEA — traces failures to systemic root causes rather than blaming humans. USE WHEN root cause, RCA, 5 whys, fishbone, postmortem, incident analysis, fault tree, why does this keep failing, blameless…
Vitals
Read-only macOS performance inspection: a deterministic CLI gathers the numbers, Interpretation.md turns them into a diagnosis instead of a data dump.
omh-failure-signal-audit
This is a Hermes-native failure-signal-audit workflow skill.
report-issue-local
File a bug or feature request against this MCP server's own repo. Use for server-specific issues — tool logic, service integrations, config problems, or domain bugs that aren't caused by the framework.
thinking-five-whys-plus
When a fault is localized and the proximate cause is known but the systemic root is not, chain evidence-linked whys with a counterfactual stop and a countermeasure.