Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/qoderai/better-harness/handoffnpx skills add QoderAI/better-harness --skill handoffgit clone --depth 1 https://github.com/QoderAI/better-harnessWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00009 | $0.00022 |
| Opus 5 | $0.00005 | $0.00011 |
| Sonnet 5 | $0.00002 | $0.00004 |
| Haiku 4.5 | $0.00001 | $0.00002 |
Grade A, and why
handoff scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Record evidence without copying private content.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 7 lines · 9 tokens per session scan A 6682b7f938eb
handoff is a skill published in the GitHub repository QoderAI/better-harness (2,130 stars, last pushed yesterday), licensed MIT. It adds 9 tokens to every session and 22 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
capability-recommender
Use when the need is read-only capability design only: skills, hooks, MCP servers, subagents, plugins, scripts, or CI/headless automation. For cross-surface workbench bootstrap or repair, use harness-builder.
plan
用于把已批准 Spec 或足够明确的非平凡请求转成 Executable Plan。触发条件：需要 active slice、planning surface、验证路径、能力缺口或 commit unit。不要在需求/验证策略不清时使用；先回 brainstorm。项目工作面不清时转 harness-builder。.
agent-instructions-maintainer
Use when durable agent instructions need audit or repair only: AGENTS.md, CLAUDE.md, .claude.md, .claude.local.md, canonical rules/.mdc, or Cursor rule mirrors. For cross-surface workbench bootstrap or repair, use harness-builder.
find-skills
Use this helper to discover reusable agent skills for a clear task or capability gap. Trigger it when the user asks how to do X, find a skill, or extend agent capabilities. Do not install or adopt a skill just because it is related; project adoption belongs to harness-builder.
harness-builder
Use when a project workbench needs bootstrap, repair, or cross-surface recommendation: route entry, recovery, verification, capability, install, and anti-entropy gaps. Thick work goes to capability-recommender, agent-instructions-maintainer, or recovery-surface-builder.
implement
用于在一个 scoped active slice 上做最小代码或文档改动。触发条件：用户请求/Spec/Executable Plan 已清楚，工作面和验证路径足够明确。不要在需求、active slice、根因或工作面不清时使用；局部检查只是反馈，ready 只能交给 verify。.