What is okf-harness-bootstrap?

A single entrypoint that routes OKF Harness requests to setup, discovery, repair, checking, data intake, reconciliation, answering, or graph work. It uses a launcher to find the workspace and run the appropriate commands.

Use it to set up or maintain a Harness workspace, inspect its status, ingest or reconcile information, edit a wiki, or run checks after changes.

It removes the need to choose a maintenance mode manually and ensures commands use the configured runtime and workspace.

okf-harness-bootstrap — Skill for Claude Code and Codex by pumblus

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add pumblus/okf-harness --skill okf-harness-bootstrap

Clone the repo

git clone --depth 1 https://github.com/pumblus/okf-harness

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/pumblus/okf-harness/okf-harness-bootstrap/github.svg)](https://agentmods.dev/skills/pumblus/okf-harness/okf-harness-bootstrap)

Your own site

<a href="https://agentmods.dev/skills/pumblus/okf-harness/okf-harness-bootstrap"><img src="https://agentmods.dev/badge/skills/pumblus/okf-harness/okf-harness-bootstrap/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/pumblus/okf-harness/okf-harness-bootstrap"><img src="https://agentmods.dev/badge/skills/pumblus/okf-harness/okf-harness-bootstrap.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 956 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 10 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 11
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 15
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 24
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 25
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 26
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 27
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 28
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 29
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 30
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 31
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.00956
Opus 5.5	$0.00000	$0.00382
Sonnet 5.5	$0.00000	$0.00191
Haiku 4.5	$0.00000	$0.00096

Measured 1mo ago against content hash 78e3be3a86f0, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

okf-harness-bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/agent-pack/templates/okf-harness-bootstrap/SKILL.md · 69 lines

How it starts

The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.

OKF Harness

This unified entrypoint routes setup and workspace maintenance without making the user choose a mode.

Required Behavior

Classify the request as setup, discovery, repair, check, ingest, reconciliation, answer, graph, or an explicit combination.
Resolve the workspace with the launcher before choosing the route:

npx @okf-harness/setup@latest launch -- status --json

Read the launcher's machine-readable result. WORKSPACE_NOT_FOUND routes to discovery or setup. RUNTIME_PIN_MISSING means run data.adoptCommand exactly and retry. CONFIG_INVALID and runtime execution failures stop the workflow with the reported problem.
For a resolved workspace, run every Harness command through npx @okf-harness/setup@latest launch --workspace <workspace> -- <runtime-arguments> and read its JSON before continuing.
Load only the setup, discovery, or repair reference when that route needs it. Daily workspace routes use the commands below.
Before persistent setup writes, state the resolved workspace name, path, and agent target unless the user supplied all three.
After any wiki edit, run the workspace check and report its status. If files changed, name the changed files.
Use the CLI data.refresh object when present without claiming that workspace-local guidance exists unless the result confirms it.

Workspace Routes

npx @okf-harness/setup@latest launch --workspace <workspace> -- check --json
npx @okf-harness/setup@latest launch --workspace <workspace> -- source add <source> --json
npx @okf-harness/setup@latest launch --workspace <workspace> -- ingest plan <source-id> --json
npx @okf-harness/setup@latest launch --workspace <workspace> -- source list --json
npx @okf-harness/setup@latest launch --workspace <workspace> -- source reconcile <prior-source-id> <revision-source-id> --note "<judgment-note>" --json
npx @okf-harness/setup@latest launch --workspace <workspace> -- evidence "<question>" --json
npx @okf-harness/setup@latest launch --workspace <workspace> -- read <concept-id-or-path> --json
npx @okf-harness/setup@latest launch --workspace <workspace> -- graph --json

Read the full file on GitHub · 69 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 69 lines · 0 tokens per session scan A 78e3be3a86f0

Subscribe to this mod's changes

okf-harness-bootstrap is a skill published in the GitHub repository pumblus/okf-harness (38 stars, last pushed 2mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 956 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Building agents Claude Code agent-skills codex knowledge-management llm-wiki local-first

shodh-memory

Persistent memory system for AI agents. Use this skill to remember context across conversations, recall relevant information, and build long-term knowledge. Activate when you need to store decisions, learnings, errors, or context that should persist beyond the current session.

varun29ankuS/shodh-memory · 53 tokens

enzyme-sqlite-source

Connect an unfamiliar SQLite database to Enzyme without changing the source data. Inspect the database, decide which query columns represent identity, people, time, content, and folders, show real examples for approval, save a workspace program in the Enzyme language, and verify init and refresh. Use for email…

byenzyme/enzyme · 83 tokens

enzyme

Use Enzyme in an already activated Obsidian, Markdown, or Hermes workspace for working-memory retrieval, source-grounded exploration, search by keyword and meaning, runtime note-writing, and refresh. If the workspace is not initialized, follow the first-time setup section before normal retrieval.

byenzyme/enzyme · 58 tokens

run-wenlan-app

Build, launch, screenshot, and drive the wenlan-app Tauri desktop app in dev mode on macOS (WKWebView) or Windows (WebView2). Use when asked to run or start the app, verify a UI change in the real running app (not just tests), or take a screenshot of it.

wenlan-app/wenlan · 71 tokens

wenlan-handoff

End a work session. Stores durable captures, writes a narrative session log, and automatically applies typed item-level deltas to the current Space Brief. Invoked as /wenlan-handoff.

wenlan-app/wenlan · 43 tokens

curate

Power-user audit of Wenlan's pending surfaces: accept or dismiss pending revisions (conflicts/merges), or audit pending captures (not yet confirmed). Most users want /brief for revisions; that handles the daily flow. Use /wenlan curate only for explicit deep-walk audits after bulk imports, or to walk the full queue…

wenlan-app/wenlan · 106 tokens