Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add RockyHong/super-bootstrap/plugin install super-bootstrapWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rockyhong/super-bootstrap/harness-bootstrap)<a href="https://agentmods.dev/skills/rockyhong/super-bootstrap/harness-bootstrap"><img src="https://agentmods.dev/badge/skills/rockyhong/super-bootstrap/harness-bootstrap.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00170 | $0.14453 |
| Opus 5 | $0.00085 | $0.07226 |
| Sonnet 5 | $0.00034 | $0.02891 |
| Haiku 4.5 | $0.00017 | $0.01445 |
Grade C, and why
harness-bootstrap scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
Throughout this skill — Phase 1 detection, anywhere Claude reads source files — **paraphrase structure into committed docs; never paste raw file contents.** Skip files whose names suggest secrets (e.g. `.env*`, `*.key`, How it starts
The opening of the file, as written. The whole thing — 603 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Super Bootstrap — Development Pipeline for Any Repo
Set up (or sync) the development pipeline in a project. Installs harness — workflow rules, doc-sync gate, skeleton docs, the core plugin pin — in one scaffold session. The doc-sync gate at every later commit grows the skeleton docs over time, so there's no deferred deep-scan stage.
Designed for a solo developer working across multiple Claude Code sessions and cloud Claude Code.
Phase 1: Quick Scan (lightweight, parallel reads)
Gather just enough to scaffold — skim manifests for stack/version, note structure shape, stop.
Check contributor count (git shortlog -sn --all | head -5). If >1 active contributor, surface as info — don't block:
"FYI: detected multiple contributors. The pipeline's CLAUDE.md assumes solo dev (simple branching, no PRs for self-review). You can edit those sections after bootstrap if your team's workflow differs."
Sampling Discipline (applies to all source-file reads)
Throughout this skill — Phase 1 detection, anywhere Claude reads source files — paraphrase structure into committed docs; never paste raw file contents. Skip files whose names suggest secrets (e.g. .env*, *.key, *.pem, id_*, *credential*, *secret*, .npmrc, .netrc, *.p12 / *.pfx, *.keystore, kubeconfig — illustrative, judge by name).
When skipping, surface to user: ⊘ skipped <path> (likely secret).
Reason: reading alone isn't the breach — Claude's context isn't shared. The breach is quoting raw content into auto-committed docs (techstack.md, overview.md): a gitignored secret becomes permanent in git history. Defense lives in the write step. The illustrative list seeds pattern recognition for the skip step; new secret-bearing patterns are judged by name, not table lookup.
Manifest Detection
Detect language/runtime by manifest files at repo root (e.g. package.json, tsconfig.json, pyproject.toml / requirements.txt, Cargo.toml, go.mod, Gemfile, pom.xml / build.gradle, composer.json, pubspec.yaml, CMakeLists.txt / Makefile, *.csproj / *.sln — illustrative, not exhaustive). Don't read fully — skim each for runtime/version, top-level deps, scripts/build commands. Cover unlisted stacks (Bun, Deno, Zig, Elixir, Gleam, etc.) by analogy from the manifest's contents.
What ships with it
26 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/bootstrap-plan.md 3.9 KB
- assets/claude-md-skeleton.md 17 KB
- assets/coding-standards-skeleton.md 721 B
- assets/decisions-skeleton.md 1.9 KB
- assets/hooks-ensure-infra.md 11 KB
- assets/hooks/commit-channel.hook.json 887 B
- assets/hooks/commit-channel.sh 2.2 KB runs code
- assets/hooks/consult-check-check.hook.json 622 B
- assets/hooks/consult-check-check.sh 2.1 KB runs code
- assets/hooks/consult-check-sessionstart.hook.json 705 B
- assets/hooks/consult-check-sessionstart.sh 5.2 KB runs code
- assets/overview-skeleton.md 1.3 KB
- assets/rename-map.md 4.1 KB
- assets/rules-frontend-skeleton.md 2.2 KB
- assets/rules-index-skeleton.md 1.0 KB
- assets/rules-mv3-skeleton.md 2.0 KB
- assets/scale/card-fact-fields.md 1.6 KB
- assets/scale/outward-readme-skeleton.md 4.2 KB
- assets/scale/outward-template-skeleton.md 655 B
- assets/scale/parked-skeleton.md 2.0 KB
- assets/scale/rules-venue-map-skeleton.md 3.3 KB
- assets/scale/split-outward.py 5.6 KB runs code
- assets/scale/test-queue-skeleton.md 2.0 KB
- assets/techstack-skeleton.md 5.3 KB
- assets/work-readme-skeleton.md 3.8 KB
- assets/work-template-skeleton.md 427 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +2 lines b3cec6f1630b
- 7d ago First seen · 601 lines · 170 tokens per session scan C ea23eed8d517
harness-bootstrap is a skill published in the GitHub repository RockyHong/super-bootstrap (3 stars, last pushed 2d ago), licensed MIT. It adds 170 tokens to every session and 14,453 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
image-upload
Grab an image from the clipboard and analyze it. Use when the user says image upload, paste, screenshot, clipboard, or asks to look at something they copied.
ln-22-codebase-auditor
Audits cross-cutting code health, security, delivery, and maintainability when no specialist audit is primary. Not for a single delivery review.
ln-51-opportunity-evaluator
Evaluates new product opportunities using demand, channels, competition, and economics. Not for committed-backlog or implementation planning.
github-pr-creation
Creates GitHub Pull Requests with automated validation and task tracking. Use when user wants to create PR, open pull request, submit for review, or check if ready for PR. Analyzes commits, validates task completion, generates Conventional Commits title and description, suggests labels. NOTE - for merging existing…
ralphctl-test-driven-development
Execute-phase skill — write the failing test before the code that makes it pass; for bug fixes, this is the reproduction test itself. Use for any logic change, bug fix, or behavioural modification; for the full root-cause triage pipeline around an unexpected failure, see ralphctl-debugging-and-error-recovery.
ralphctl-idea-refinement
Ideation skill — refine a raw, unshaped idea into a sharp, buildable concept through divergent expansion (variation lenses like inversion, simplification, audience shift) followed by convergent stress-testing (user value, feasibility, differentiation), ending in a one-pager with explicit assumptions and a "Not Doing"…