phrazzld/harness
skills/harness/SKILL.md
Build and repair Spellbook primitives: skills, shared doctrine, provider roster, harness configs, gates, evals, bootstrap, and sync logic. Use for "improve the harness", "bootstrap is wrong", "AGENTS.md is stale", "skill health", "eval skill", "sync primitives", "roster defaults". Trigger: /harness, /skill, /primitive.
$ install --global
skillsauthnpx skillsauth add phrazzld/agent-skills harnessInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 28, 2026, 6:12 AM280.8s10 files scanned
SKILL.md
- name:
- harness
- description:
- |
- Build and repair Spellbook primitives:
- skills, shared doctrine, provider
- Trigger:
- /harness, /skill, /primitive.
- argument-hint:
- [create|eval|lint|convert|sync|engineer|audit|models] [target]
/harness
Mutate the harness. Keep it thin.
Route
| Need | Load |
|---|---|
| create skill/agent | references/mode-create.md |
| eval skill | references/mode-eval.md |
| lint skill | references/mode-lint.md |
| convert agent/skill | references/mode-convert.md |
| sync externals | references/mode-sync.md |
| engineer doctrine/gates/hooks | references/mode-engineer.md |
| audit catalog | references/mode-audit.md |
| open-model defaults | references/open-model-roster.md |
Contract
- Fix root cause in the highest-leverage layer: type/test/hook/gate/skill/ AGENTS, in that order.
- Prefer deletion. Harness prose is context tax.
- Cross-harness first: Claude, Codex, Pi. Filesystem +
SKILL.mdis primary. - Skills stay self-contained: scripts/references under the skill; state roots from invoking repo.
- Spellbook source skills live in
skills/; repo-local.agents/skills/and harness-specific skill bridge dirs are/seedoutput for consumer repos. - Generated/root
AGENTS.mdis a router, not a manual. Keep non-obvious facts only. - System bootstrap exposes the full first-party skill catalog; repo-local vendoring is exceptional and must earn its complexity.
- Provider CLIs are tools. Do not wrap them in semantic orchestration unless a shaped ticket explicitly asks.
Delegation Floor
If a provider roster is available (repo .spellbook/agents.yaml or system ~/.spellbook/agents.yaml), dispatch two or more providers for
substantive harness work and record receipts. Use lanes for doctrine critique,
runtime compatibility, gate design, and regression risk. Give each lane scoped
files and expected output; the lead owns final semantics, verification, and
receipt evidence. Direct work is for mechanical commands, emergency unblocks,
explicit user-forbidden delegation, or fewer than two available providers.
Do not treat a missing repo-local roster as a waiver. Run the resolver-backed
probe, which falls back to the system Spellbook roster:
python3 $SPELLBOOK_ROOT/scripts/probe-agent-roster.py.
Native in-thread subagents may supplement the investigation, but they do not
satisfy the roster floor. Count only configured provider ids in receipts and
final roster reports.
Quality Bar
SKILL.mdencodes judgment, not a procedure the model already knows.- Put long mode detail in
references/; keep the entry file short. - Ad-hoc roster lanes beat static project subagents unless tool permissions must be isolated.
- New mechanisms include a gate, eval, or smoke path.
- Every run ends clean: no untracked or modified files.
Gotchas
- Stale AGENTS prose is worse than missing prose.
- Duplicated repo-local skill copies are usually stale context unless a repo needs checked-in vendored harness state.
- Regexes over agent prose are usually the wrong boundary.
- If a rule matters, enforce it outside prose.
Related Skills
phrazzld/compound
testing
VerifiedTrustedCommunity
Capture one compounding repo-technical learning while a solved problem is still fresh. Use when: after a bug fix, diagnosis, delivery, review, or incident reveals a reusable pattern worth adding to `docs/solutions/`. Trigger: /compound, /capture-learning, /learning.
13SKILL.mdUpdated Jul 5, 2026
phrazzld/factory-apps
testing
VerifiedTrustedCommunity
Route Misty Step factory application capabilities. Use when choosing, auditing, integrating, or operating Canary, Powder, Landmark, Aesthetic, or Bitterblossom: production observability, incidents, health checks, error logging, backlog/work-card state, release intelligence, UI/UX system adoption, or supervised/unsupervised agent dispatch. Trigger: /factory-apps, /factory-stack.
13SKILL.mdUpdated Jul 4, 2026
phrazzld/skill-eval
testing
VerifiedTrustedCommunity
Prove a skill beats no-skill with a falsifiable A/B eval, or retire it. Design, generate, run, and maintain a skill-specific eval: name the one claim the skill must earn, run it skill-on vs raw same-model, grade blind with objective checks first, return a keep/adapt/cut verdict. Use when: "eval this skill", "does this skill help", "prove the skill beats no skill", "write an eval for", "benchmark a skill", "is this skill worth it", "skill A/B", "skill regression test", "generate skill evals". Trigger: /skill-eval, /eval-skill, /prove-skill.
13SKILL.mdUpdated Jul 2, 2026
phrazzld/skills/harness-engineering/templates/repo-local-skill
tools
VerifiedTrustedCommunity
> Template. Copy to `<target-repo>/.agents/skills/<repo>-<domain>/SKILL.md` > and fill every bracketed placeholder from the live target repo. Delete this > line and every other `> ` guidance line before committing. See > `../../references/repo-local-skill-generation.md` for the full process. --- name: <repo>-<domain> description: | [One paragraph: what this skill verifies/runs/operates for <repo>, stated in terms of the repo's real shape (service/CLI/library/etc.), not generic process. En
13SKILL.mdUpdated Jul 2, 2026