oornnery/agent-harness
skills/agent-harness/SKILL.md
Build, review, or validate AI agent harnesses and runtimes. Use for prompt assembly, context builders, memory, tools, permissions, approvals, model providers, turn runners, sessions, hooks, traces, evals, replay, and operational safety.
tools
Updated Jun 4, 2026
$ install --global
skillsauthnpx skillsauth add oornnery/.agents agent-harnessInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 4, 2026, 7:40 AM259.3s1 file scanned
SKILL.md
- name:
- agent-harness
- description:
- Build, review, or validate AI agent harnesses and runtimes. Use for prompt assembly, context builders, memory, tools, permissions, approvals, model providers, turn runners, sessions, hooks, traces, evals, replay, and operational safety.
Agent Harness
Use for model-calling systems where context, tools, permissions, memory, traces, and runtime control must be explicit.
Boundaries
- Harness: prompt assembly, context building, model calls, tool calling, parsing, approvals.
- Runtime: sessions, workers, retries, queues, recovery, orchestration.
- Memory: short-term context, durable project facts, retrieval, compaction, redaction.
- Tools: schemas, adapters, execution wrappers, permission gates.
Pair with:
skills/building-agents/SKILL.mdfor broader agent-building guidanceskills/project-state/SKILL.mdfor state/memory filesskills/security/SKILL.mdfor permissions, prompt injection, secrets, and tool riskskills/verification/SKILL.mdfor evals, replay, static checks, and runtime validation
Workflow
- Map actors, model providers, tool surface, permissions, memory, session lifecycle, and high-risk actions.
- Make instruction precedence and prompt assembly inspectable.
- Keep tool schemas, arguments, return values, and errors explicit.
- Gate risky tools by action, path, scope, or approval.
- Bound execution with max steps, retries, cancellation, and timeouts.
- Persist enough trace/state to debug and replay critical flows.
- Verify with provider mocks, tool mocks, policy tests, parser recovery, and replay/eval cases.
Core Rules
- No hidden instruction injection paths.
- No vague "do everything" tools hiding side effects.
- Validate tool input before execution and output before reuse.
- Separate read-only, write, network, execution, and destructive tool classes.
- Treat stale memory, prompt injection, unsafe delegation, and over-broad permissions as first-class risks.
- Fail closed for unsafe actions; fail open only for harmless convenience helpers.
Suggested Layout
src/myapp/
├── harness/
├── runtime/
├── prompts/
├── tools/
├── permissions/
├── context/
├── memory/
├── parser/
├── evals/
├── storage/
└── traces/
Verification
- prompt assembly precedence
- provider mock and streaming behavior
- tool schema validation
- permission and approval decisions
- malformed output and parser recovery
- retry, timeout, cancellation, max-step behavior
- replay/eval fixtures for important tasks
Related Skills
oornnery/skills/verification
development
VerifiedTrustedCommunity
--- name: verification description: Discover and run project validation gates: format, lint, typecheck, LSP diagnostics, tests, build, static security checks, dependency audits, and RTK output handling. Use before claiming work is complete, when fixing broken checks, or when setting up a validation plan. --- # Verification Use this skill to prove changes with the strongest practical checks the repo already supports. ## Discovery Order 1. Read task aliases: `package.json`, `pyproject.toml`, `
SKILL.mdUpdated Jun 4, 2026
oornnery/uv-script
tools
VerifiedTrustedCommunity
Build, review, or validate standalone Python scripts run with uv inline metadata. Use for one-file automation, operational scripts, script dependencies, shebangs, idempotency, safety, representative runs, and promoting scripts to packages.
SKILL.mdUpdated Jun 4, 2026
oornnery/python-library
development
VerifiedTrustedCommunity
Build, review, or validate Python packages and libraries where public API stability, packaging metadata, imports, examples, changelogs, build output, and compatibility matter.
SKILL.mdUpdated Jun 4, 2026
oornnery/python-cli
tools
VerifiedTrustedCommunity
Build, review, or validate Python command-line applications and terminal tools. Use for argparse, Typer, Rich, Textual-adjacent CLI UX, stdout/stderr contracts, exit codes, automation-friendly flags, help output, and CLI tests.
SKILL.mdUpdated Jun 4, 2026