Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/paladini/harness-score/releasenpx skills add paladini/harness-score --skill releasegit clone --depth 1 https://github.com/paladini/harness-scoreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/paladini/harness-score/release)<a href="https://agentmods.dev/skills/paladini/harness-score/release"><img src="https://agentmods.dev/badge/skills/paladini/harness-score/release.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.00867 |
| Opus 5 | $0.00018 | $0.00434 |
| Sonnet 5 | $0.00007 | $0.00173 |
| Haiku 4.5 | $0.00004 | $0.00087 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Releasing harness-score
- Verify green:
npm test,npm run lint,npm run scan(must be L4),npm run docs:build. - Bump versions together — preferably via changesets: run
npm run version-packages(runschangeset version, which bumpspackages/cli/package.jsonand writespackages/cli/CHANGELOG.mdfrom accumulated.changeset/*.mdfiles, thenscripts/sync-version.mjs, which mirrors the new version intoTOOL_VERSION,jsr.json,package-lock.json, and both GitHub Action entrypoints — changesets doesn't know about those project-specific files). Review the diff. If no changesets were added since the last release, bumppackages/cli/package.jsonby hand and runnode scripts/sync-version.mjs.plugins/cursor/.cursor-plugin/plugin.json(+ entry inplugins/cursor/CHANGELOG.md) — only if Cursor plugin content changed, it has its own release trackplugins/claude-code/.claude-plugin/plugin.json— only if Claude Code plugin content changed; no separate publish step, a version bump- push to
mainis the entire release (the marketplace is this repo)
- push to
- Commit
release: vX.Y.Z, tagvX.Y.Z, push with tags. - Create a GitHub Release from that tag — use the new
packages/cli/CHANGELOG.mdentry as the notes body if changesets produced one, otherwisegh release create vX.Y.Z --generate-notes— this fires.github/workflows/release.yml, which publishes to all three registries via OIDC, no secrets stored anywhere:- npmjs.org as
harness-score, via Trusted Publishing — the user configures this once on the package's npmjs.com settings page (repo + workflow filename), then every CI run authenticates automatically, bypassing the 2FA/OTP prompt entirely. - GitHub Packages as
@paladini/harness-score(automatic, uses the built-inGITHUB_TOKEN, no secret needed — the repo's Actions "Workflow permissions" must be set to Read and write). - JSR as
@paladini/harness-score(automatic via OIDC — but the scope must be claimed once by the user at jsr.io/new before the first publish succeeds). If the GitHub Action changed, select Publish this Action to the GitHub Marketplace. Use Code quality as the primary category and Continuous integration as the secondary category.
- npmjs.org as
- After the release workflow succeeds, move the matching stable Action major
tag (
v1for av1.x.yrelease):git tag -f vN vX.Y.Z && git push origin vN --force. Never move the major tag before the released Action and registry jobs pass. - If npm Trusted Publishing isn't configured yet,
npm publishin CI will fail with a clear error; the user completes the one-time npmjs.com setup and the next run succeeds — no manual local publish needed once it's on. - Cursor Marketplace: the listing updates from the repo — remind the user
to resubmit at https://cursor.com/marketplace/publish only if
plugins/cursor/metadata changed. Claude Code has no separate marketplace to resubmit to — see step 2. - Docs deploy automatically via
.github/workflows/pages.ymlon push to main.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 60 lines · 37 tokens per session scan A 39478eb3890d
release is a skill published in the GitHub repository paladini/harness-score (199 stars, last pushed 7d ago), licensed MIT. It adds 37 tokens to every session and 867 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
git-workflow-and-versioning
Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple parallel streams. Use when cutting a release, choosing a semantic version bump…
skillshare-changelog
Generate CHANGELOG.md entry from recent commits in conventional format. Also syncs the website changelog page. Use this skill whenever the user asks to: generate a changelog, document what changed between tags, or create a new CHANGELOG entry. If you see requests like "write the changelog for v0.17", "what changed…
github-release-briefing-skill
Create a source-linked briefing for the latest published GitHub release of a public repository. Use for engineering teams tracking a dependency release; do not use it to publish releases or change repositories.
macos-packaging-notarization
Prepare macOS packaging and notarization workflows. Use when archiving apps, validating bundles, or explaining distribution-only failures.
changelog
Auto-generates a changelog from git commits, sprint data, and design documents. Produces both internal and player-facing versions.
share-a-library
Use when a managed library is ready to publish to GitHub and hand to teammates as an install command. Run the GitHub publishing steps, then return the exact shareable install command.