Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add onsager-ai/dev-skills --skill harness-operationsgit clone --depth 1 https://github.com/onsager-ai/dev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/onsager-ai/dev-skills/harness-operations)<a href="https://agentmods.dev/skills/onsager-ai/dev-skills/harness-operations"><img src="https://agentmods.dev/badge/skills/onsager-ai/dev-skills/harness-operations/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/onsager-ai/dev-skills/harness-operations"><img src="https://agentmods.dev/badge/skills/onsager-ai/dev-skills/harness-operations.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.00740 |
| Opus 5.5 | $0.00024 | $0.00296 |
| Sonnet 5.5 | $0.00012 | $0.00148 |
| Haiku 4.5 | $0.00006 | $0.00074 |
Grade A, and why
harness-operations scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Harness operations
Scope
This skill owns capability selection and native mechanics, not repository policy. It never supplies publication, merge, credential, spending or cross-repo authority. AGENTS.md and the task remain the contract; native adapter prose translates tools.
Prerequisites
Determine the actual harness from session/runtime diagnostics, not a branch prefix or presence of a file. Inspect the available tool catalog and observed configured authentication. A checked-in skill does not provision a connector, CLI or token.
Procedure
- Identify the needed operation and whether it is read-only or an authorized mutation. Prefer an already available configured capability; do not add personal setup as a default prerequisite. Carry forward authorization for the same action and scope. Resolve routine implementation choices independently; request a human decision only when its answer is required to proceed or materially changes the intended outcome.
- Load only the matching native reference: Claude Code, Codex or ChatGPT Work. If the harness is different or uncertain, use observed tools and report the missing mapping instead of pretending one profile applies.
- For GitHub, resolve the exact repository/ref and use connected GitHub tools when available. An authenticated supported CLI is an alternative when exposed. Match operations and parameter schemas from the actual catalog; a tool name in an example is not evidence it exists in this session.
- Check capabilities separately: issue/PR reads, file/tree publication, run/check metadata, log bodies, commit statuses and subscriptions may have different availability. Avoid a blanket claim that a connector cannot read logs. Retain the actual error and use an equivalent exposed capability where available.
- For a pending human decision, use the exposed, permitted structured question tool from the matching native reference. Include the concrete choice, context and tradeoffs; wait for an explicit answer before dependent work and reconcile the decision record. Continue independent authorized work. A plain-text question or checklist is not a substitute for an available question tool. Do not re-ask settled decisions or treat silence/default selections as approval. If the question capability is unavailable, state the limitation and use the established human handoff channel; native permission and product approval gates still apply.
- Preserve configured identity, proxy and trust. Never print credentials, inspect secret files for values, dump the environment, or replace credentials because a token is not visible. Diagnose 401/403 using current runtime observations. Try an equivalent configured tool before requesting installation, login or broader permissions. Report the failing operation and actual error rather than making setup for one tool a prerequisite for all work.
- If no equivalent exists, finish independent work and report the exact blocked operation. Do not turn missing subscriptions into invented background monitoring or missing publication into a claim that an issue/PR was created.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +1 lines · +4 tokens per session ae7dc9b93a64
- 10d ago Changed · +6 lines e743e9660f2a
- 13d ago First seen · 57 lines · 57 tokens per session scan A 06f67b31513b
harness-operations is a skill published in the GitHub repository onsager-ai/dev-skills (6 stars, last pushed 7d ago), licensed MIT. It adds 61 tokens to every session and 740 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-04.
Other skills, from other repositories
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…