phrazzld/skills/harness-engineering/templates/repo-local-skill
skills/harness-engineering/templates/repo-local-skill/SKILL.md
> Template. Copy to `<target-repo>/.agents/skills/<repo>-<domain>/SKILL.md` > and fill every bracketed placeholder from the live target repo. Delete this > line and every other `> ` guidance line before committing. See > `../../references/repo-local-skill-generation.md` for the full process. --- name: <repo>-<domain> description: | [One paragraph: what this skill verifies/runs/operates for <repo>, stated in terms of the repo's real shape (service/CLI/library/etc.), not generic process. En
$ install --global
skillsauthnpx skillsauth add phrazzld/agent-skills skills/harness-engineering/templates/repo-local-skillInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 2, 2026, 6:13 AM165.2s2 files scanned
SKILL.md
Template. Copy to
<target-repo>/.agents/skills/<repo>-<domain>/SKILL.mdand fill every bracketed placeholder from the live target repo. Delete this line and every other>guidance line before committing. See../../references/repo-local-skill-generation.mdfor the full process.
name: <repo>-<domain> description: | [One paragraph: what this skill verifies/runs/operates for <repo>, stated in terms of the repo's real shape (service/CLI/library/etc.), not generic process. End with explicit trigger phrasing: "Use when: '<phrase>', '<phrase>'. Trigger: /<repo>-<domain>."] argument-hint: "[<surface1>|<surface2>|<surface3>]"
<!-- Generated via harness-kit's repo-local skill generation pattern (skills/harness-engineering/references/repo-local-skill-generation.md). Source repo: <owner/repo> @ <sha>. Generated: <YYYY-MM-DD>. Generator ref: harness-kit@<sha used to generate this>. Facts below are repo-derived at generation time, not invented. Re-verify commands against the live repo before trusting this if it has aged — a generated skill is a snapshot, not a live view. --><repo>-<domain>
[One or two sentences: what "<domain>" means in this repo specifically, and the one deterministic gate/command that is necessary-but-not-sufficient (name it, name what it can't prove).]
Surfaces
Only include rows for surfaces this repo actually has. Delete the rest. Every cell is a real path/command from the live repo, not a placeholder genre.
| Changed area | Surface | Verification path |
|---|---|---|
| <path-glob> | [HTTP service / CLI / library / worker / SDK] | [exact command(s)] |
Commands
Exact, copy-pasted invocations. Include the one-time setup a cold agent needs (env vars, local DB path, ports) and the fallback if the default port/resource is taken. If the repo's CI workflow differs from what AGENTS.md/README claims, name the mismatch here instead of picking one.
[real command 1]
[real command 2]
Gotchas
Repo-specific footguns a cold agent would otherwise rediscover the hard way — pulled from AGENTS.md/CLAUDE.md's own footgun list, docs/, or the generation author's own dry run. Not generic advice ("write tests").
- [gotcha 1]
- [gotcha 2]
Report
Return: verdict (PASS / FAIL / UNVERIFIED) · exact command(s) run · surface(s) exercised · artifact/output inspected · what was NOT covered.
Related Skills
phrazzld/compound
testing
VerifiedTrustedCommunity
Capture one compounding repo-technical learning while a solved problem is still fresh. Use when: after a bug fix, diagnosis, delivery, review, or incident reveals a reusable pattern worth adding to `docs/solutions/`. Trigger: /compound, /capture-learning, /learning.
13SKILL.mdUpdated Jul 5, 2026
phrazzld/factory-apps
testing
VerifiedTrustedCommunity
Route Misty Step factory application capabilities. Use when choosing, auditing, integrating, or operating Canary, Powder, Landmark, Aesthetic, or Bitterblossom: production observability, incidents, health checks, error logging, backlog/work-card state, release intelligence, UI/UX system adoption, or supervised/unsupervised agent dispatch. Trigger: /factory-apps, /factory-stack.
13SKILL.mdUpdated Jul 4, 2026
phrazzld/skill-eval
testing
VerifiedTrustedCommunity
Prove a skill beats no-skill with a falsifiable A/B eval, or retire it. Design, generate, run, and maintain a skill-specific eval: name the one claim the skill must earn, run it skill-on vs raw same-model, grade blind with objective checks first, return a keep/adapt/cut verdict. Use when: "eval this skill", "does this skill help", "prove the skill beats no skill", "write an eval for", "benchmark a skill", "is this skill worth it", "skill A/B", "skill regression test", "generate skill evals". Trigger: /skill-eval, /eval-skill, /prove-skill.
13SKILL.mdUpdated Jul 2, 2026
phrazzld/artifact
development
VerifiedTrustedCommunity
Produce a consistently-styled, self-contained HTML report served privately over Tailscale. One house template (Silver Age comic-ops palette, dark/light toggle, and a mandatory copy-page button) so every report an agent hands the operator looks and behaves the same. Use when: "make an HTML artifact/report", "serve this over tailscale", "write up a brief/report/dashboard as a page", or any time you'd otherwise dump a long analysis into chat. Trigger: /artifact.
13SKILL.mdUpdated Jul 2, 2026