Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ruvnet/metaharness --skill create-harnessgit clone --depth 1 https://github.com/ruvnet/metaharnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ruvnet/metaharness/create-harness)<a href="https://agentmods.dev/skills/ruvnet/metaharness/create-harness"><img src="https://agentmods.dev/badge/skills/ruvnet/metaharness/create-harness/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ruvnet/metaharness/create-harness"><img src="https://agentmods.dev/badge/skills/ruvnet/metaharness/create-harness.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 3 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 38 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00089 | $0.00789 |
| Opus 5.5 | $0.00036 | $0.00316 |
| Sonnet 5.5 | $0.00018 | $0.00158 |
| Haiku 4.5 | $0.00009 | $0.00079 |
Grade A, and why
create-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
create-harness
This skill scaffolds an AI agent harness — your own focused, branded harness with its own npx <name> CLI, MCP server registration, memory namespace, learning loop, and marketplace identity.
When to use this skill
Use this skill when the user wants any of:
- A custom MCP-server-backed AI assistant (legal, trading, support, ops, …)
- A Claude Code plugin that bundles their own agents/skills/prompts
- A Codex skill that wraps a kernel + tools
- A pi.dev extension or Hermes agent runtime config
- A standalone npm package they can
npm publishunder their own scope
How to invoke
/create-harness
The skill asks for:
- Harness name (kebab-case, e.g.
legal-redline) - Description (one line)
- Host(s) — Claude Code, Codex, pi.dev, Hermes (multi-select)
- Template —
minimal(default),vertical:trading,vertical:support,vertical:devops,vertical:legal,vertical:research, oreject-from-ruflo - Memory backend — AgentDB (default), SQLite-only, in-memory
- Routing strategy — 3-tier (default) or single-tier
- Marketplace — independent (no ruflo branding) or powered-by
Under the hood
Calls npx create-agent-harness <name> with the user's choices, copies the chosen template into the current directory, runs the post-generation smoke test, and emits a .harness/manifest.json so future updates can harness upgrade cleanly (copier-style regenerate-diff-merge).
Outputs
| File | Purpose |
|---|---|
package.json |
The harness's npm package, ready to npm publish |
bin/<name>.js |
The CLI binary your users invoke |
.claude/settings.json (if Claude Code host) |
MCP + hooks wiring |
.codex/config.toml (if Codex host) |
MCP table in TOML |
AGENTS.md + SYSTEM.md (if pi.dev host) |
Pi extension instructions |
cli-config.yaml (if Hermes host) |
Hermes runtime config |
.harness/manifest.json |
Generator state — drives drift detection (ADR-008) |
witness.json |
Ed25519-signed provenance manifest (ADR-011) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 71 lines · 89 tokens per session scan A ab4941a7cffa
create-harness is a skill published in the GitHub repository ruvnet/metaharness (709 stars, last pushed yesterday), licensed MIT. It adds 89 tokens to every session and 789 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-agent
Agent skill for agent - invoke with $agent-agent.
agent-crdt-synchronizer
Agent skill for crdt-synchronizer - invoke with $agent-crdt-synchronizer.
agent-performance-benchmarker
Agent skill for performance-benchmarker - invoke with $agent-performance-benchmarker.
agent-quorum-manager
Agent skill for quorum-manager - invoke with $agent-quorum-manager.
agent-topology-optimizer
Agent skill for topology-optimizer - invoke with $agent-topology-optimizer.
flow-nexus-platform
Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges.