Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add ondrej-svec/heart-of-gold-toolkit/plugin install marvinWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ondrej-svec/heart-of-gold-toolkit/harness-up)<a href="https://agentmods.dev/skills/ondrej-svec/heart-of-gold-toolkit/harness-up"><img src="https://agentmods.dev/badge/skills/ondrej-svec/heart-of-gold-toolkit/harness-up/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ondrej-svec/heart-of-gold-toolkit/harness-up"><img src="https://agentmods.dev/badge/skills/ondrej-svec/heart-of-gold-toolkit/harness-up.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00112 | $0.02800 |
| Opus 5.5 | $0.00045 | $0.01120 |
| Sonnet 5.5 | $0.00022 | $0.00560 |
| Haiku 4.5 | $0.00011 | $0.00280 |
Grade A, and why
harness-up scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 213 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Harness Up
A repository that confuses an agent confuses a teammate too. The fix isn't a longer prompt — it's the smallest durable operating surface that points the next pair of hands, human or model, at the next safe move. This skill installs that surface.
Boundaries
This skill MAY: read repo state, ask scoping questions, write doctrine docs (AGENTS.md, CLAUDE.md, docs/agents-md-standard.md, docs/plans/README.md, ADR/solutions templates), create .claude/settings.json (or merge), record marketplace add commands in a setup section, scaffold empty docs/ subdirectories with README stubs.
This skill MAY NOT: write application source code, write tests, install npm/pnpm/pip dependencies (that is marvin:scaffold's job), run tests or builds, deploy, modify production state, overwrite an existing AGENTS.md without merging.
You install doctrine. You do not write the application.
Common Rationalizations
| Shortcut | Why It Fails | The Cost |
|---|---|---|
| "Skip the survey — drop in the template" | Templates bury real conventions; downstream links go dead | AGENTS.md routes agents to files that don't exist; the first session breaks on a 404 |
| "Add every plugin — they're free" | Each plugin loads on every session; cognitive load compounds | Slow starts, abandoned skills, contributors disabling the lot |
| "Empty repo, no brainstorm — fill in later" | Doctrine without mission reads generic | Agent has no routing anchor; produces boilerplate every invocation |
| "Copy the reference shape 1:1" | The doctrine describes a shape, not a section list; every repo owns different surfaces | Sections nobody owns rot into doctrine debt within weeks |
When NOT to Use
- Application scaffolding (deps, source, tests) is what's actually needed — use
marvin:scaffold. - A single section needs a rewrite — edit that file; running the full skill is overkill.
- The repo is a one-off prototype with no team or future maintainers — doctrine is overhead it won't pay back.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 213 lines · 112 tokens per session scan A 16076ee5794c
harness-up is a skill published in the GitHub repository ondrej-svec/heart-of-gold-toolkit (19 stars, last pushed 1mo ago), licensed MIT. It adds 112 tokens to every session and 2,800 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
harness-up compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| harness-upondrej-svec/heart-of-gold-toolkit | Skill | 19 | 1mo ago | MIT | A | 112 | Claude Code |
| imagegenopenai/codex | Skill | 134k | today | Apache-2.0 | A | 113 | Codex |
| playwright-climicrosoft/playwright | Skill | 99k | today | Apache-2.0 | A | 19 | Claude Code |
| local-ai-agentsmicrosoft/ai-agents-for-beginners | Skill | 79k | today | MIT | A | 200 | Claude Code, Codex |
| systematic-debuggingobra/superpowers | Skill | 314k | 3d ago | MIT | A | 21 | Claude Code |
| next-cache-components-adoptionvercel/next.js | Skill | 143k | yesterday | MIT | A | 95 | Claude Code |
| next-partial-prefetching-adoptionvercel/next.js | Skill | 143k | yesterday | MIT | A | 103 | Claude Code |