PenguinHarness is a local-first platform in which multiple AI agents create, evaluate, optimize, and deploy agent applications. It is for people building AI software who want agents to generate applications and improve their own behavior through skills.
Borrowing it
Nothing to install: this file belongs to Prism-Shadow/penguin-harness. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Prism-Shadow/penguin-harness/main/.agents/skills/penguin-harness-manual-test/SKILL.mdgit clone --depth 1 https://github.com/Prism-Shadow/penguin-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/prism-shadow/penguin-harness/penguin-harness-manual-test)<a href="https://agentmods.dev/skills/prism-shadow/penguin-harness/penguin-harness-manual-test"><img src="https://agentmods.dev/badge/skills/prism-shadow/penguin-harness/penguin-harness-manual-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/prism-shadow/penguin-harness/penguin-harness-manual-test"><img src="https://agentmods.dev/badge/skills/prism-shadow/penguin-harness/penguin-harness-manual-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.01280 |
| Opus 5 | $0.00039 | $0.00640 |
| Sonnet 5 | $0.00015 | $0.00256 |
| Haiku 4.5 | $0.00008 | $0.00128 |
Grade A, and why
penguin-harness-manual-test scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**`curl` returns 502 but the server is fine.** A shell `http_proxy` routes loopback through the How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Standing PenguinHarness up to test by hand
Node >= 24. dev:* runs dev-prebuild.mjs first (keeps pnpm install current, prebuilds
workspace deps); pnpm desktop runs a full pnpm -r build, so it is slow to start.
Entry points
| Command | Open | Data root |
|---|---|---|
pnpm dev |
http://localhost:7365 | ~/.penguin/dev-data |
pnpm desktop |
its own window | ~/.penguin/dev-data |
pnpm dev:landing |
http://localhost:7366 | none (static) |
pnpm dev:docs |
http://localhost:7367 | none (static) |
Other fixed ports (packages/core/src/internal/ports.ts): 7364 installed server, 7368 dev backend,
7369 pnpm penguin web (data root ~/.penguin/dev-data-cli — its own, so it can serve while an
Agent it hosts runs pnpm dev; the lock is per root). On a shared box, ss -tln before assuming
one is free; PORT= inline moves it.
The user's installed app, server and CLI all use ~/.penguin/data — their real Agents, Sessions
and keys. Never point a dev run there. Both surfaces print the root they took (Data root: …,
[shell] dev instance … on data root …); read it rather than assume.
Four ways a working setup looks broken
7368 shows a stale app. The dev backend also serves packages/web/dist — the last
pnpm -r build, not what Vite is serving. Screenshot 7365, never 7368.
curl returns 502 but the server is fine. A shell http_proxy routes loopback through the
proxy. Use curl --noproxy '*'. Browsers and the server itself are unaffected.
/api on 127.0.0.1 returns 401. That address is reserved as the Workspace-preview host. Use
localhost.
The server exits 3 saying the data root is in use. Another instance — usually the user's own
desktop app — holds <root>/server.lock. The lock is per root, not per port, so PORT= will not
get past it. Use a different root; do not kill their process.
One instance at a time
Only one local dev instance runs at a time, counting every agent's. A separate root gets you past the lock but not past the browser: cookies and the admin claim are shared across instances, so bringing a second one up corrupts the first's session state. Stop the previous PR's instance before starting the next.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +24 lines 59fa431d57c3
- 13d ago First seen · 73 lines · 77 tokens per session scan A 08853b9c1c49
penguin-harness-manual-test is a skill published in the GitHub repository Prism-Shadow/penguin-harness (2,105 stars, last pushed today), licensed Apache-2.0. It adds 77 tokens to every session and 1,280 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
web-ui-test
Test the IronClaw web UI using the Claude for Chrome browser extension.
langbot-testing
Test LangBot WebUI and core product flows with an automated browser and backend logs. Use when validating the configured LangBot frontend, pipeline Debug Chat, model provider setup and test buttons, bot and knowledge-base UI flows, or troubleshooting failed LangBot end-to-end tests.
browser-testing-with-screenshots
Use when testing web applications with visual verification - automates Chrome browser interactions, element selection, and screenshot capture for confirming UI functionality.
local-test
Build, run, and test IronClaw locally using Docker containers and Chrome MCP browser automation.
run-dashboard-e2e-local-changes
Run Playwright E2E (tests/e2e/) against the docker/ all-in-one harness so it reflects LOCAL code changes, not a stale cached image.
browser-qa
Drive a real headless browser against a locally-served web UI and capture screenshot evidence, reporting step-level PASS/FAIL/BLOCKED with extracted DOM text and console errors. Use when a phase on the docker QA image must exercise a rendered UI and attach screenshots — it complements the text-evidence verify/qa-test…