PenguinHarness is a local-first platform in which multiple AI agents create, evaluate, optimize, and deploy agent applications. It is for people building AI software who want agents to generate applications and improve their own behavior through skills.
Borrowing it
Nothing to install: this file belongs to Prism-Shadow/penguin-harness. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Prism-Shadow/penguin-harness/main/.agents/skills/penguin-harness-frontend/SKILL.mdgit clone --depth 1 https://github.com/Prism-Shadow/penguin-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/prism-shadow/penguin-harness/penguin-harness-frontend)<a href="https://agentmods.dev/skills/prism-shadow/penguin-harness/penguin-harness-frontend"><img src="https://agentmods.dev/badge/skills/prism-shadow/penguin-harness/penguin-harness-frontend/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/prism-shadow/penguin-harness/penguin-harness-frontend"><img src="https://agentmods.dev/badge/skills/prism-shadow/penguin-harness/penguin-harness-frontend.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 111 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.10961 |
| Opus 5.5 | $0.00036 | $0.04384 |
| Sonnet 5.5 | $0.00018 | $0.02192 |
| Haiku 4.5 | $0.00009 | $0.01096 |
Grade A, and why
penguin-harness-frontend scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 601 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Frontend conventions
packages/web is React 19 + Vite + Tailwind CSS 4, with no cn/clsx, no tailwind-merge, and no
variants library. Classes are composed with template literals, and a component's variants are a
Record<Key, string> next to it (button.tsx's variantClass, input.tsx's sizeClass). Match
that shape; do not introduce a styling dependency.
This file records the decisions that already exist so they are not re-litigated per PR. Read
penguin-harness-dev for the repo-wide contract (verification chain, changelog, two-repo layout).
Start in the shared UI package
Before adding or changing a control on any frontend, inspect packages/ui/src/index.ts,
packages/ui/src/site.ts and the relevant component under packages/ui/src/components/. Reuse its component, hook or class helper. When it
lacks the behavior needed by the app, extend that shared component and update its callers. A
reusable interaction or visual rule belongs in packages/ui; each host supplies domain data,
routing, translated labels, preference persistence and actions. Do not copy a shared control into a feature or patch its defaults in
packages/web/src/styles.css.
Extract a common component or hook when the same interaction appears in multiple places. Keep the abstraction at the concrete behavior being shared; a one-off business rule stays with its feature. During review, check for duplicated markup, page-local overrides and call sites that bypass the shared component. Verify the shared change in the gallery and in a representative host surface.
Landing, docs and gallery chrome
Use @prismshadow/penguin-ui/site for the shared SiteHeader, SiteNavLinks,
SiteLanguageMenu, SiteThemeToggle, SiteGitHubLink and site icons, and for what the sites'
pages share: SiteFooter, SiteCodeCard, SiteCopyButton, SitePill, SiteMarkdown (article
prose with SiteCodeBlock and SiteCodeTabs; the docs pass SITE_DOC_REMARK_PLUGINS and every
site passes highlightSiteCode), SiteToc with useActiveTocEntry, SiteSidebarNav,
SiteSearchDialog, SiteExternalLink, the preference providers (SiteThemeProvider,
SiteLocaleProvider, the shared penguin-site.* keys) and useRouteScroll. Import
@prismshadow/penguin-ui/site.css for their scoped appearance and shared cursors; a site's
Tailwind entry also imports site-page.css (the dark variant, the brand scale, the neutral dark
ramp, body defaults). This entry is independent of the app renderer and full theme; public sites
do not need the app's bundled fonts just to render a page, nor the theme icon sets: a site control
draws line icons (site-icons, CheckLineIcon) and builds menu rows with MenuRow, never
GlyphIcon, MenuItem or a mark drawn in every set, any of which carries the sets into the
landing and docs bundles. Their wrappers only adapt routes, labels, content and preferences. Do
not restore copied navbar markup, language-menu event handlers, theme cycles, footers, copy
buttons or Markdown typography in a site package.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +4 lines 8ec8641bcb56
- yesterday Changed · +10 lines dc70cf138a64
- 2d ago Changed · +3 lines f93db6c84f46
- 8d ago Changed · +5 lines d1e251b19ad8
- 9d ago Changed · +7 lines e624552d791c
- 10d ago Changed · +17 lines 69c2aa3d4954
- 11d ago Changed · +56 lines · +91 tokens per session 83f93abce491
- 13d ago Changed · +1 lines 4c33c30c329d
- 14d ago Changed · +130 lines · -156 tokens per session e82b6e605bca
- 22d ago First seen · 368 lines · 156 tokens per session scan A 57e6fb395cf9
penguin-harness-frontend is a skill published in the GitHub repository Prism-Shadow/penguin-harness (2,975 stars, last pushed today), licensed Apache-2.0. It adds 91 tokens to every session and 10,961 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ui-craft
Design, build, redesign, or modify browser-visible web interfaces with product-quality composition, visual systems, interaction states, responsive behavior, accessibility, and browser visual QA. Use for HTML, CSS, JavaScript, React, Vue, or Svelte pages and components, landing pages, dashboards, admin tools, settings…
shadcn
Manages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. Applies when working with shadcn/ui, component registries, presets, --preset codes, or any project with a components.json…
dashboard
Update the agent's Control Center. Use when the user says "update my Control Center", "update my dashboard", "redesign my home", or "/dashboard".
tailwind-design-system
Build scalable design systems with Tailwind CSS v4, design tokens, component libraries, and responsive patterns. Use when creating component libraries, implementing design systems, or standardizing UI patterns.
anti-slop-frontend
A mechanical, countable anti-slop checklist for AI-generated frontend. Catches the specific signatures an undirected model defaults to: AI-purple glows, Inter-everywhere, em-dashes, div-based fake screenshots, eyebrow-on-every-section, beige+brass "premium" palettes, generic Jane Doe / Acme data. Advisory layer that…
accessibility-a11y
Semantic HTML, keyboard navigation, focus states, ARIA labels, skip links, and WCAG contrast requirements. Use when ensuring accessibility compliance, implementing keyboard navigation, or adding screen reader support.