Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add shimo4228/claude-harness --skill skill-complygit clone --depth 1 https://github.com/shimo4228/claude-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shimo4228/claude-harness/skill-comply)<a href="https://agentmods.dev/skills/shimo4228/claude-harness/skill-comply"><img src="https://agentmods.dev/badge/skills/shimo4228/claude-harness/skill-comply/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shimo4228/claude-harness/skill-comply"><img src="https://agentmods.dev/badge/skills/shimo4228/claude-harness/skill-comply.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.04089 |
| Opus 5 | $0.00023 | $0.02044 |
| Sonnet 5 | $0.00009 | $0.00818 |
| Haiku 4.5 | $0.00005 | $0.00409 |
Grade B, and why
skill-comply scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
workspace でも `<sandbox>/.claude/settings.json` の `hooks.SessionStart` は How it starts
The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.
skill-comply: Automated Compliance Measurement
Measures whether coding agents actually follow skills, rules, or agent definitions by:
- Auto-generating expected behavioral sequences (specs) from any .md file
- Auto-generating scenarios with decreasing prompt strictness (supportive → neutral → competing)
- Running
claude -pand capturing tool call traces via stream-json - Classifying tool calls against spec steps using LLM (not regex)
- Checking temporal ordering deterministically
- Generating self-contained reports with spec, prompts, and timelines
Supported Targets
- Skills (
skills/*/SKILL.md): Workflow skills like search-first, TDD guides - Rules (
rules/common/*.md): Mandatory rules like testing.md, security.md, debugging.md - Agent definitions (
agents/*.md): Whether an agent gets invoked when expected (internal workflow verification not yet supported)
When to Activate
- User runs
/skill-comply <path> - User asks "is this rule actually being followed?"
- After adding new rules/skills, to verify agent compliance
- Periodically as part of quality maintenance
Usage
# 前提: scripts/ と pyproject.toml はこのスキルのディレクトリにあり、
# `python -m scripts.run` の解決は cwd 依存のため、まずスキルディレクトリへ cd する
# (`uv run --project` だけでは module 解決できないことを 2026-07-13 に実測確認)
cd ~/.claude/skills/skill-comply
# Full run
uv run python -m scripts.run ~/.claude/rules/common/testing.md
# Dry run (no cost, spec + scenarios only)
uv run python -m scripts.run --dry-run ~/.claude/skills/search-first/SKILL.md
# Custom models
uv run python -m scripts.run --gen-model haiku --model sonnet --classifier-model sonnet <path>
# 直列に戻す(レートリミットに当たったとき)
uv run python -m scripts.run --concurrency 1 <path>
# Bash を要する spec のみ (既定は off — 下の「信頼境界」を読んでから)
uv run python -m scripts.run --allow-bash <path>
# 保存済み spec を再利用して run 間比較 (LLM 再生成をスキップ)
uv run python -m scripts.run --spec results/<skill-name>.spec.yaml <path>
spec の固定と run 間比較: spec は「試験問題」。LLM 生成のたびに required steps 数も
順序制約も変わるため、生成された spec は自動で results/<skill-name>.spec.yaml に保存される
(gitignore 対象外 — version 管理できる)。同じ skill を再測定するときは --spec でこれを
読み込むと問題文が固定され、スコアが比較可能になる。次回の生成 run は同名ファイルを
上書きするので、比較対象として残したい spec は別名でコピーしておく。
なお scenario prompt は引き続き毎回 LLM 生成で変動する — run 間比較の固定は spec までで、
scenario の非決定性は現状スコープ外。
What ships with it
31 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .gitignore 68 B
- fixtures/compliant_trace.jsonl 1.0 KB
- fixtures/noncompliant_trace.jsonl 629 B
- fixtures/tdd_spec.yaml 1.2 KB
- prompts/classifier.md 2.6 KB
- prompts/scenario_generator.md 3.4 KB
- prompts/spec_generator.md 4.2 KB
- pyproject.toml 299 B
- scripts/__init__.py 0 B runs code
- scripts/child_settings.py 3.7 KB runs code
- scripts/classifier.py 3.8 KB runs code
- scripts/grader.py 5.8 KB runs code
- scripts/parser.py 4.5 KB runs code
- scripts/report.py 8.6 KB runs code
- scripts/run.py 30 KB runs code
- scripts/runner.py 26 KB runs code
- scripts/scenario_generator.py 3.2 KB runs code
- scripts/spec_generator.py 3.8 KB runs code
- scripts/target.py 7.0 KB runs code
- tests/test_child_settings.py 3.8 KB runs code
- tests/test_classifier.py 5.6 KB runs code
- tests/test_grader.py 13 KB runs code
- tests/test_parser.py 3.8 KB runs code
- tests/test_report.py 2.8 KB runs code
- tests/test_run_parallel.py 17 KB runs code
- tests/test_runner.py 8.1 KB runs code
- tests/test_sandbox_run_scope.py 6.1 KB runs code
- tests/test_sandbox_setup.py 15 KB runs code
- tests/test_spec_generator.py 1.3 KB runs code
- tests/test_target.py 7.2 KB runs code
- uv.lock 20 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · -4 lines 0e31e461b6c8
- 9d ago First seen · 220 lines · 47 tokens per session scan B deb1a7c39fa2
skill-comply is a skill published in the GitHub repository shimo4228/claude-harness (2 stars, last pushed 3d ago), licensed MIT. It adds 47 tokens to every session and 4,089 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
iterate
Autonomous multi-cycle problem solver for complex tasks that require diagnosis → fix → test → verify loops. Use when the user says things like "make this work", "test this end-to-end", "fix and verify", "iterate until working", "do cycles", "keep going until it passes", or when a task clearly requires multiple rounds…
jest
Jest best practices, patterns, and API guidance for JavaScript/TypeScript testing. Covers mock design, async testing, matchers, timer mocks, snapshots, module mocking, configuration, and CI optimization. Baseline: jest ^30.0.0. Triggers on: jest imports, describe, it, test, expect, jest.fn, jest.mock, jest.spyOn…
coding-quality-loop
Use when a coding agent must turn a software goal, bug, issue, or refactor into a small, verified, independently reviewed code change.
test-integrity-gate
Use when AI-written code or tests claim green and you need deterministic proof that the new test catches the old bug.
agent-adoption-triage
Five-question triage for routing AI work to the right architecture — script, algorithmic search, LLM workflow, or autonomous agentic loop — before any agent is built. Use when someone says "let's build an agent for X", when deciding whether a use case actually needs an autonomous agent, when reviewing an agent…
zod-testing
Testing patterns for Zod schemas using Jest and Vitest. Covers schema correctness testing, mock data generation, error assertion patterns, integration testing with API handlers and forms, snapshot testing with z.toJSONSchema(), and property-based testing. Baseline: zod ^4.0.0. Triggers on: test files for Zod schemas…