Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/spacezephyr/build-your-harness/better-your-harness)<a href="https://agentmods.dev/skills/spacezephyr/build-your-harness/better-your-harness"><img src="https://agentmods.dev/badge/skills/spacezephyr/build-your-harness/better-your-harness/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/spacezephyr/build-your-harness/better-your-harness"><img src="https://agentmods.dev/badge/skills/spacezephyr/build-your-harness/better-your-harness.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00197 | $0.02382 |
| Opus 5 | $0.00098 | $0.01191 |
| Sonnet 5 | $0.00039 | $0.00476 |
| Haiku 4.5 | $0.00020 | $0.00238 |
Grade A, and why
better-your-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.
better-your-harness
给一个本地项目做 AI 协作环境的体检，输出一份自包含的可视化 HTML 报告。
铁律
这三条不是建议，是必须守住的底线。违反任何一条，这个 Skill 就失去价值。
1. 数字只能来自扫描脚本，你不许编。
报告里出现的每一个数字，都必须能在 findings.json 里找到出处。不确定的量不写，写不出来就说「未统计」。仓库可见性走 gh repo view，不许从 remote URL 猜。参考反面教材：某商业工具把一个 PRIVATE 仓库报成 public，还把仓主名字写错了，直接导致最高优先级那条的风险定级失真。
2. 任何密钥的值都不许进入报告、对话或修复口令。
扫描器只会给你「文件路径 + 变量名 + 命中的模式名」，你也只能写这些。不要为了「让用户确认」去读 .env 的内容，不要在口令里让 Agent 打印这些文件。发现密钥的正确反应是让用户加 ignore，不是展示它。
3. 只能给已有的 finding 填判断，不许发明新 finding。
findings.json 里的 findings 数组是脚本产出的候选，每条带固定 id。你在 analysis.json 里只能对这些 id 写 severity / title / why / fix_prompt。看到脚本没扫到的问题，可以在 verdict 里用一句话提，不要伪造成一条带证据的发现。
流程
1. 扫描
python3 ~/.claude/skills/better-your-harness/scripts/scan.py <项目根目录> -o /tmp/harness/findings.json
大仓库约 15-30 秒。脚本会打印各层覆盖度和候选发现数。
2. 读 JSON，写判断
完整读一遍 findings.json（通常 100-300KB，重点看 findings、score、security、context、usage）。然后写 analysis.json：
{
"verdict": "3-5 句话的总判断。先说哪里搭得好，再说最要命的窟窿在哪，用具体数字。",
"layers": {
"security": { "comment": "一句话点评这一层" },
"context": { "comment": "..." },
"tools": { "comment": "..." },
"memory": { "comment": "..." },
"learning": { "comment": "..." }
},
"findings": [
{
"id": "必须是 findings.json 里已有的 id",
"severity": "high | medium | low | info",
"title": "一句话说清是什么问题，带上关键数字",
"why": "为什么这是问题。讲清楚它在什么情况下会真的咬人，不要空泛地说不规范。",
"fix_prompt": "给 Claude Code / Codex 的完整口令。留空表示这条不需要修。"
}
]
}
3. 渲染
python3 ~/.claude/skills/better-your-harness/scripts/render.py /tmp/harness/findings.json \
-a /tmp/harness/analysis.json -o <项目>/harness-report.html
报告是自包含单页，双击就能看，可以直接发给别人。
4. 交付
告诉用户报告在哪，口头复述最高优先级的 1-2 条，其余让他自己在报告里看。不要把整份报告在对话里重述一遍。
定级标准
别把所有东西都报成高危，会让用户直接无视整份报告。
| 级别 | 什么情况 |
|---|---|
| high | 会导致数据泄露、数据丢失，或已经在发生的实质损害。密钥暴露只有在公开仓库或已被 git 跟踪时才算 high |
| medium | 明显降低 Agent 有效性，或者是 high 的必要前置条件。比如没有 .gitignore、Skill 缺 description |
| low | 卫生问题，修了更好，不修也能过。索引悬空、README 缺失 |
| info | 观察，不一定是问题。可能是用户的刻意设计 |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 149 lines · 197 tokens per session scan A 14822b7957cc
better-your-harness is a skill published in the GitHub repository SpaceZephyr/build-your-harness (29 stars, last pushed 26d ago), licensed MIT. It adds 197 tokens to every session and 2,382 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
article-writing
Write articles, guides, blog posts, tutorials, newsletter issues, and other long-form content in a distinctive voice derived from supplied examples or brand guidance. Use when the user wants polished written content longer than a paragraph, especially when voice consistency, structure, and credibility matter.
deploy-docker-compose
Run the Omnigent server as a Docker compose stack (server + Postgres) on any Docker host — your laptop, a VPS, EC2 by hand, or as the base layer of any container-platform deploy. Invoke when the user wants to build the image, bring up the compose stack, debug the stack on a host they already have, or extend the stack…
printing-press-import
Bring a published CLI from the public library into the internal library so it's identical to a freshly-generated copy — module path reverted, manuscripts placed alongside, ready for /printing-press-polish or /printing-press-emboss. Use when the public library has a CLI you don't have locally, or to recover from a…
taiyi-ui-design
A design-planning guide for describing how an application's user interface should look and behave. It produces a UI-DESIGN.md document covering layouts, components, interactions, accessibility, and error states.
remove
Remove a deployed framework or addon from the current workspace.
ln-62-repository-publisher
Commits, pushes, and remotely verifies authorized repository changes. Not for releases, package publication, or announcements.