Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add shimo4228/claude-harness --skill skill-stocktakegit clone --depth 1 https://github.com/shimo4228/claude-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shimo4228/claude-harness/skill-stocktake)<a href="https://agentmods.dev/skills/shimo4228/claude-harness/skill-stocktake"><img src="https://agentmods.dev/badge/skills/shimo4228/claude-harness/skill-stocktake/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shimo4228/claude-harness/skill-stocktake"><img src="https://agentmods.dev/badge/skills/shimo4228/claude-harness/skill-stocktake.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.05410 |
| Opus 5 | $0.00051 | $0.02705 |
| Sonnet 5 | $0.00020 | $0.01082 |
| Haiku 4.5 | $0.00010 | $0.00541 |
Grade A, and why
skill-stocktake scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Enumerates other installed skillslowAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
find ~/.claude/skills -name SKILL.md -newermt "$(jq -r .evaluated_at ~/.claude/skills/skill-stocktake/results.json)" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Copies of this mod
1 near-identical copy found in the catalogue:
- skill-stocktake — 91% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 374 lines — stays where its author put it; the contents beside it link to each section on GitHub.
skill-stocktake — Skill Quality Audit
Evaluate installed skills and assign each a verdict: Keep / Improve / Update / Retire / Merge, plus Out of scope for skills this harness does not own (Phase 0). This skill
does NOT do the improving — once it has a verdict, it hands off to skill-creator (the
improvement engine). That boundary is the point: stocktake is the quality gate,
skill-creator is the fixer.
Design note (v3.1). Per-item quality/freshness and set-level existence/overlap are different properties. Deterministic checks are code-owned and unconditional; per-item judgment gets narrow, fresh contexts; set-level judgment gets a light description sweep with targeted deep reads. Historical verdict counts and named past outcomes stay in git history, not in this operational prompt: prior outcomes anchor a new audit toward reproducing them instead of judging the current library.
Modes ($ARGUMENTS)
| Argument | Behavior |
|---|---|
none / full |
Evaluate every skill (default) |
changed |
Re-evaluate only skills whose SKILL.md mtime is newer than results.json's evaluated_at; carry the rest forward from the ledger. Phase 0 and Phase 3 still run over the full set (structural debt, overlap, and contradiction are set properties) |
changed detects changes inline (no script):
find ~/.claude/skills -name SKILL.md -newermt "$(jq -r .evaluated_at ~/.claude/skills/skill-stocktake/results.json)"
Phase 0 — Structural pre-pass (deterministic, code-owned)
Run BEFORE any LLM judgment. These checks never ride on per-item attention:
- skill-health scan — dangling references / missing artifacts across the library
(run its scanner per
~/.claude/skills/skill-health/SKILL.md). Mandatory, not optional: this is the structural layer of Curate (ADR-0019 layering), and the v2.2 verification showed exactly these defects slipping through judgment-owned checks. - Ledger hygiene — for every
results.jsonentry: the path must exist on disk and the key must follow the canonical rule below. Dedup violations (same path under two keys → keep the canonical key, delete the duplicate). Entries whose path no longer exists are removed (note them in the report as retired-from-disk). - Existence before judgment — a skill that fails the existence check never reaches Phase 2. Do not let an LLM assign Keep to a file that is not there (this happened: two nonexistent paths carried Keep verdicts in the 2026-07-05 ledger).
- Ownership before judgment — the same skill-health run reports
external: skills whose directory is a symlink out of the skills root (a package manager's tree, a sibling checkout). These do not get an Improve/Update verdict. Record them asOut of scopewith the owner and real path in the reason, and route any real defect upstream (issue / PR). A verdict here is not actionable — an edit lands in someone else's tree, never reaches git, and disappears on their next upgrade. Live miss on 2026-07-25:hunk-reviewdrew an Improve for a stale flag table and the fix was written into/opt/homebrew/Cellar/hunk/0.17.1/…; it was reverted and filed as modem-dev/hunk#595. The check is fully structural (is_symlink()), so it belongs in code, never in per-item attention.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · -1 lines 13fc4ca73c75
- 10d ago First seen · 375 lines · 102 tokens per session scan A e2d29b37c3d1
skill-stocktake is a skill published in the GitHub repository shimo4228/claude-harness (3 stars, last pushed 4d ago), licensed MIT. It adds 102 tokens to every session and 5,410 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-adoption-triage
Five-question triage for routing AI work to the right architecture — script, algorithmic search, LLM workflow, or autonomous agentic loop — before any agent is built. Use when someone says "let's build an agent for X", when deciding whether a use case actually needs an autonomous agent, when reviewing an agent…
job-description-skill
A job-description analysis skill that turns a vacancy listing and a candidate’s background into an HTML report about fit, gaps, interview topics, and application strategy.
offer-compare-skill
A decision assistant for comparing two or more job offers across pay, growth, company strength, team risk, promotion, AI exposure, and lifestyle. Total compensation means the combined value of salary, bonuses, shares, and sign-on payments.
offer-toolkit-skill
A set of job-search tools covering the path from finding a vacancy to accepting an offer. It includes separate tools for job searches, job-description analysis, tailored resumes, behavioral interviews, offer comparisons, and salary negotiation.
bq-skill
A coaching workflow for building a reusable library of truthful stories for behavioral job interviews. It uses structures such as STAR—Situation, Task, Action, Result—and can connect stories to a job description and résumé.
linkedin-job-search-skill
A job-search assistant that uses a sample job description and your resume to find and rank similar public LinkedIn Jobs listings. LinkedIn Jobs is LinkedIn’s section for advertised employment positions.