Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add shimo4228/claude-harness --skill harness-syncgit clone --depth 1 https://github.com/shimo4228/claude-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shimo4228/claude-harness/harness-sync)<a href="https://agentmods.dev/skills/shimo4228/claude-harness/harness-sync"><img src="https://agentmods.dev/badge/skills/shimo4228/claude-harness/harness-sync.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00194 | $0.06244 |
| Opus 5 | $0.00097 | $0.03122 |
| Sonnet 5 | $0.00039 | $0.01249 |
| Haiku 4.5 | $0.00019 | $0.00624 |
Grade A, and why
harness-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 252 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/harness-sync — 公開 repo への一方向エクスポート
ローカルの生きた harness (~/.claude) と公開 artifact repo は目的の違う別 repo として保ち、 remote 直結ではなく filter 付き一方向コピーで同期する。公開境界は script の origin filter 1 箇所で宣言的に管理される。
なぜ remote 直結にしないか
- ~/.claude は実行時状態 (settings, metrics, session 情報) を含む生きたディレクトリで、 gitignore の永久警戒を前提にした公開はミス耐性がゼロ
- origin filter は出自の記録であって再配布権の整理ではない (外部 origin はライセンス 整備が別途必要)
- 目的の違う repo 間は丸コピが調整コスト最小 (duplicate over coordination)
Workflow
1. Dry-run で差分を確認
bash <公開repo>/scripts/sync-from-local.sh --dry-run
差分の要約 (新規 / 変更 / 削除されるコンポーネント) をユーザーに提示する。
2. 公開スコープ確認
task request / approved plan に列挙された repo と component は追加確認なしで進める。 列挙外の repo・新規公開 component が見つかった場合だけ scope change として停止する。
3. 適用
bash <公開repo>/scripts/sync-from-local.sh
script は staging 収集 → runtime artifact 除去 (results.json, pycache 等) → frontmatter YAML 検証 (GitHub 等の厳密パーサ基準。invalid なら abort) → secret scan (検出時 abort) → skills/ agents/ rules/ docs/adr/ rfcs/ hooks/ scripts/hooks/ tests/ subtree の置換、まで行う。origin filter が効くのは skills/ agents/ rules/ だけで、 残り 3 系統は別の規則で決まる (いずれも集約 repo のみ):
docs/adr/— ADR はハーネス自身の設計判断の記録で定義上すべて自作のため、origin filter を 掛けずディレクトリ丸ごとが対象。以後の ADR は公開される前提で書く。rfcs/— 台帳エントリも自作の判断記録なので ADR と同じく丸ごと (ADR-0049)。起票は公開可能な書き方が既定 — 機微はリンク先へ (task-stocktake の公開規約)。hooks/scripts/hooks/tests/— script 内のHOOK_ALLOWLISTに列挙したファイルだけ。 公開は provenance でなく curation の判断 (ADR-0038)。公開対象の hook を追加・rename したら allowlist を更新する — source に無い entry があると sync は abort する。scripts/claims.py(台帳 CLI、rfcs/ の消費側) も allowlist 経由 — subtree 外に置かれるため削除は伝播しない (delist したら公開 repo 側で手動削除)。install 手順の正本は 公開 repo のdocs/hooks.mdで、これは subtree の外にある (中に置くと sync で消える)。 script は commit しない。LLM 側で diff と secret scan の結果を確認してから次へ進む。
4. ドキュメント整合 (LLM 側の責務)
構成が変わったら、公開 repo の以下を確認する:
README.md/README.ja.mdの skill/agent/rule テーブルは GENERATED マーカー間で apply 時に script 自動再生成される（skills-table/agents-table/rules-table。 membership は origin filter が正、Purpose 列は既存キュレーションを保持し新規のみ seed）。 手で直すのは Purpose 文面と周辺 prose のみ。集約カウント（"N skills" 等）はどこにも 書かない（No-volatile-state。churning count は焼き込むと drift する）- repo の About（description）も同様に volatile-free に保つ — 数字を入れず、
価値提案（何を pick できるか）で記述する。
gh repo edit --descriptionで編集 docs/hooks.md— script 生成ではない手書き doc。hook の発火条件・bypass 変数・settings.json断片・bats 被覆を持つので、公開 hook を足す / 挙動を変えたら手で追随するllms.txt/llms-full.txt— 退役した component の行を消すのは機械検査で確認する （下の「AI 向け導線のリンク切れ」）。文面の質はllms-txt-writerに defer- 集約 repo README の「Upstream components」節も script 生成（marker 間を apply 時に 自動再生成、外部 origin の名前のみ・ECC トップリンクのみ）— 手で編集しない
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 34eca8666678
- 2d ago Changed · -7 lines 181cfcdb16c9
- 7d ago First seen · 259 lines · 194 tokens per session scan A a552e96b7c1a
harness-sync is a skill published in the GitHub repository shimo4228/claude-harness (2 stars, last pushed yesterday), licensed MIT. It adds 194 tokens to every session and 6,244 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
git-commit
A guided Git commit workflow that examines changes and creates a commit message using the Conventional Commits format, a shared style for labeling changes such as features, fixes, tests, or documentation.
pi-sync
Daily upstream-sync job for the pi Go port — fetch upstream pi, triage every change since the recorded pin, port what's in scope, verify idiomatic + parity via independent reviews, update the ledger, and push. Use for "sync with upstream", "porting job", or as the scheduled daily run.
upstream-contribute
Scan the current session for harness-level patterns that would be useful to other rockie users, then either package a reviewed local harness patch or dispatch a public upstream contribution PR. Uses Scout/Generator/Verifier/Updater separation, never auto-merges, and requires human sign-off before pushing. Triggers…
clean
Pre-commit anti-slop audit — checks staged/dirty files for code slop (debug artifacts, single-use helpers, dead imports) AND documentation slop (stale claims, broken internal links, new .md files, redundant sections). Writes a sentinel so the pre-commit-gate hook lets the commit through. MUST be invoked before git…
trailhead-chart
Skill "trailhead-chart" from ToRvaLDz/trailhead, covering load first, in order, routing: verb to engine, chart a new map / adopt a project: new, adopt, open a ticket on the fly: ticket and triage the inbox: inbox [issue].
trailhead-manage
Skill "trailhead-manage" from ToRvaLDz/trailhead, covering load first, in order and routing: verb to engine.