Harness is an AI Agent development guardrail Meta-Skill that establishes four layers of defense for any project in one command: knowledge management, architecture constraints, feedback loops, and entropy management.
Dispatch an independent challenger agent to adversarially review a spec or implementation plan against the actual codebase. Catches hallucinated APIs, wrong field names, nonexistent files, and incorrect assumptions. Two modes: (1) spec review — verifies DB model fields, API paths, config attributes, file paths…
Graph-driven project understanding using code-review-graph (CRG). Query architecture, modules, callers/callees, impact radius, hotspots, execution flows, and search nodes. Use when: (1) brainstorming and need to understand project structure, (2) writing plans and need impact analysis, (3) user says "understand this…
Manage code knowledge graphs via code-review-graph (CRG). Build, update, and check status of project code graphs stored in .code-review-graph/graph.db. Use when: (1) user says "build graph", "update graph", "graph status", "/graph", (2) Harness init detects CRG, (3) preparing to use /explore commands. Gracefully…
Skill "harness-audit" from xwtro0tk1t-cloud/harness, covering harness audit — project health check, behavior, checklist, a. infrastructure (max 25 points) and b. skill ecosystem (max 30 points).
An AI-assisted review of software-component vulnerability scans from tools such as Grype, Snyk, and Xray. It groups findings by urgency from P0 to P3 and filters out lower-impact results.
A generator for security-review skills tailored to a project, programming language, or framework. It can create audit rules from project documentation or reference materials.
A security audit for Docker and container deployment files, including Dockerfiles, Docker Compose files, Kubernetes YAML, and Helm charts. It checks for issues such as root or privileged containers, exposed secrets, unsafe mounts, missing resource limits, and risky network settings.
A security checker for Terraform and related infrastructure-as-code files that describe AWS cloud resources. It looks for unsafe settings in HCL, Terraform JSON, tfvars, and Terragrunt files.
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
Audit AI Agent skills for security vulnerabilities including malicious code, remote execution, credential leaks, and supply chain risks. Use when reviewing third-party skills, investigating suspicious behavior, or performing security assessments.
A supply-chain security checker for detecting malicious changes in software dependencies across several programming languages. A supply-chain attack hides harmful behavior in packages, build steps, or installation scripts.
A web vulnerability testing skill for finding and checking security flaws in websites and web applications. It can use HTTP requests, browser automation, or a group of specialized security agents for more complex work.
★not rated 265 4mo agoA0 tokens
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: