harden

Name: harden
Author: Soul-Brews-Studio

109stars55forks

How to install harden?

soul-brews-studio/arra-oracle-skills-cli/harden

$npx -y skills add Soul-Brews-Studio/arra-oracle-skills-cli --skill harden

Installs into the current project.

Summary

Audit Oracle configuration for safety, governance, and hardening. Use when user says "harden", "audit", "security check", "governance", or wants to verify oracle setup.

Files · 1

View on GitHub

SKILL.md

1	# /harden — Oracle Governance Audit
2
3	> Sharp instruments need safe sheaths. The Whetstone hardens what it sharpens.
4
5	Audit an Oracle's configuration for safety, governance compliance, and operational hardening. Catches misconfigurations before they become incidents.
6
7	## Usage
8
9	```
10	/harden # Quick audit — check all, report issues
11	/harden --full # Deep audit — check all + suggest fixes
12	/harden --secrets # Secrets scan only — .env, keys, tokens
13	/harden --rules # Golden rules compliance check
14	/harden --fix # Auto-fix safe issues (with confirmation)
15	```
16
17	---
18
19	## Step 0: Detect Oracle Root
20
21	```bash
22	date "+🕐 %H:%M %Z (%A %d %B %Y)" && ORACLE_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
23	if [ -n "$ORACLE_ROOT" ] && [ -f "$ORACLE_ROOT/CLAUDE.md" ] && { [ -d "$ORACLE_ROOT/ψ" ] \|\| [ -L "$ORACLE_ROOT/ψ" ]; }; then
24	PSI="$ORACLE_ROOT/ψ"
25	echo "✅ Oracle root: $ORACLE_ROOT"
26	else
27	echo "❌ Not in an oracle repo. /harden requires CLAUDE.md + ψ/ directory."
28	exit 1
29	fi
30	```
31
32	---
33
34	## Step 1: Secrets Scan
35
36	Check for leaked secrets in tracked files:
37
38	```bash
39	# Check for common secret patterns in git-tracked files
40	cd "$ORACLE_ROOT"
41
42	echo "🔍 Scanning for secrets..."
43
44	# .env files that shouldn't be tracked
45	git ls-files \| grep -E '\.env($\|\.)' \| grep -v '\.example' \| while read f; do
46	echo "🚨 CRITICAL: $f is tracked by git!"
47	done
48
49	# Common secret patterns in tracked files (excluding binary)
50	git ls-files \| xargs grep -l -E '(PRIVATE_KEY\|API_KEY\|SECRET_KEY\|password\|token\|Bearer [a-zA-Z0-9]\|sk-[a-zA-Z0-9]{20,})' 2>/dev/null \| grep -v -E '(node_modules\|\.lock\|SKILL\.md\|CLAUDE\.md)' \| while read f; do
51	echo "⚠️ Possible secret in: $f"
52	done
53	```
54
55	### .gitignore Checks
56
57	```bash
58	# Essential ignores for oracle repos
59	MISSING_IGNORES=""
60	for pattern in ".env" "node_modules/" ".DS_Store" "ψ/active/" "ψ/memory/logs/"; do
61	if ! grep -qF "$pattern" "$ORACLE_ROOT/.gitignore" 2>/dev/null; then
62	MISSING_IGNORES="$MISSING_IGNORES\n ❌ Missing: $pattern"
63	fi
64	done
65
66	if [ -n "$MISSING_IGNORES" ]; then
67	echo "📋 .gitignore gaps:$MISSING_IGNORES"
68	else
69	echo "✅ .gitignore covers essentials"
70	fi
71	```
72
73	---
74
75	## Step 2: Golden Rules Compliance
76
77	Read CLAUDE.md and verify the 5 Principles + Rule 6 are present:
78
79	```bash
80	echo "📜 Checking Golden Rules..."
81	CLAUDE_MD="$ORACLE_ROOT/CLAUDE.md"
82	```
83
84	Check for:
85
86	\| Rule \| Search Pattern \| Required \|
87	\|------\|---------------\|----------\|
88	\| Nothing is Deleted \| `Nothing is Deleted` \| Yes \|
89	\| Patterns Over Intentions \| `Patterns Over Intentions` \| Yes \|
90	\| External Brain \| `External Brain` \| Yes \|
91	\| Curiosity Creates \| `Curiosity Creates` \| Yes \|
92	\| Form and Formless \| `Form and Formless` \| Yes \|
93	\| Rule 6 (Transparency) \| `Oracle Never Pretends` \| Yes \|
94	\| No force push \| `force` or `--force` in golden rules \| Yes \|
95	\| No rm -rf \| `rm -rf` in golden rules \| Yes \|
96	\| No secrets \| `secrets` or `.env` in golden rules \| Yes \|
97
98	Report missing principles as warnings.
99
100	---
101
102	## Step 3: Brain Structure Audit
103
104	Verify ψ/ directory structure:
105
106	```bash
107	echo "🧠 Checking brain structure..."
108	PSI_REAL=$(readlink -f "$PSI" 2>/dev/null \|\| echo "$PSI")
109
110	for dir in inbox memory writing lab learn active archive outbox; do
111	if [ -d "$PSI_REAL/$dir" ]; then
112	COUNT=$(find "$PSI_REAL/$dir" -type f 2>/dev/null \| wc -l)
113	echo " ✅ ψ/$dir/ ($COUNT files)"
114	else
115	echo " ⚠️ ψ/$dir/ missing"
116	fi
117	done
118	```
119
120	### ψ/ Symlink Check
121
122	```bash
123	if [ -L "$ORACLE_ROOT/ψ" ]; then
124	TARGET=$(readlink "$ORACLE_ROOT/ψ")
125	echo " 🔗 ψ → $TARGET"
126	if [ ! -d "$TARGET" ]; then
127	echo " 🚨 Symlink target doesn't exist!"
128	fi
129	else
130	echo " 📁 ψ/ is a regular directory"
131	fi
132	```
133
134	---
135
136	## Step 4: Identity Verification
137
138	Check CLAUDE.md has required identity fields:
139
140	```bash
141	echo "🪪 Checking identity..."
142	```
143
144	\| Field \| Pattern \| Required \|
145	\|-------\|---------\|----------\|
146	\| Name \| `I am` or `name:` \| Yes \|
147	\| Human \| `Human:` \| Yes \|
148	\| Purpose \| `Purpose:` \| Yes \|
149	\| Born \| `Born:` \| Recommended \|
150	\| Theme \| `Theme:` \| Recommended \|
151	\| Node \| `Node:` \| For fleet oracles \|
152
153	---
154
155	## Step 5: Operational Checks
156
157	### Git Config
158
159	```bash
160	echo "⚙️ Checking git config..."
161	# Verify git user is set (not default)
162	GIT_USER=$(git config user.name 2>/dev/null)
163	GIT_EMAIL=$(git config user.email 2>/dev/null)
164	echo " User: $GIT_USER <$GIT_EMAIL>"
165
166	# Check for dangerous aliases
167	git config --get-regexp alias 2>/dev/null \| grep -E '(force\|reset.hard\|clean.-f)' && echo " ⚠️ Dangerous git aliases found"
168	```
169
170	### Installed Skills Check
171
172	```bash
173	echo "🔧 Checking installed skills..."
174	if [ -d "$ORACLE_ROOT/.claude/settings" ] \|\| [ -f "$

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

harden

109stars55forks

View on GitHub

How to install harden?

soul-brews-studio/arra-oracle-skills-cli/harden

$npx -y skills add Soul-Brews-Studio/arra-oracle-skills-cli --skill harden

Installs into the current project.

Summary

Audit Oracle configuration for safety, governance, and hardening. Use when user says "harden", "audit", "security check", "governance", or wants to verify oracle setup.

Files · 1

View on GitHub

SKILL.md

1	# /harden — Oracle Governance Audit
2
3	> Sharp instruments need safe sheaths. The Whetstone hardens what it sharpens.
4
5	Audit an Oracle's configuration for safety, governance compliance, and operational hardening. Catches misconfigurations before they become incidents.
6
7	## Usage
8
9	```
10	/harden # Quick audit — check all, report issues
11	/harden --full # Deep audit — check all + suggest fixes
12	/harden --secrets # Secrets scan only — .env, keys, tokens
13	/harden --rules # Golden rules compliance check
14	/harden --fix # Auto-fix safe issues (with confirmation)
15	```
16
17	---
18
19	## Step 0: Detect Oracle Root
20
21	```bash
22	date "+🕐 %H:%M %Z (%A %d %B %Y)" && ORACLE_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
23	if [ -n "$ORACLE_ROOT" ] && [ -f "$ORACLE_ROOT/CLAUDE.md" ] && { [ -d "$ORACLE_ROOT/ψ" ] \|\| [ -L "$ORACLE_ROOT/ψ" ]; }; then
24	PSI="$ORACLE_ROOT/ψ"
25	echo "✅ Oracle root: $ORACLE_ROOT"
26	else
27	echo "❌ Not in an oracle repo. /harden requires CLAUDE.md + ψ/ directory."
28	exit 1
29	fi
30	```
31
32	---
33
34	## Step 1: Secrets Scan
35
36	Check for leaked secrets in tracked files:
37
38	```bash
39	# Check for common secret patterns in git-tracked files
40	cd "$ORACLE_ROOT"
41
42	echo "🔍 Scanning for secrets..."
43
44	# .env files that shouldn't be tracked
45	git ls-files \| grep -E '\.env($\|\.)' \| grep -v '\.example' \| while read f; do
46	echo "🚨 CRITICAL: $f is tracked by git!"
47	done
48
49	# Common secret patterns in tracked files (excluding binary)
50	git ls-files \| xargs grep -l -E '(PRIVATE_KEY\|API_KEY\|SECRET_KEY\|password\|token\|Bearer [a-zA-Z0-9]\|sk-[a-zA-Z0-9]{20,})' 2>/dev/null \| grep -v -E '(node_modules\|\.lock\|SKILL\.md\|CLAUDE\.md)' \| while read f; do
51	echo "⚠️ Possible secret in: $f"
52	done
53	```
54
55	### .gitignore Checks
56
57	```bash
58	# Essential ignores for oracle repos
59	MISSING_IGNORES=""
60	for pattern in ".env" "node_modules/" ".DS_Store" "ψ/active/" "ψ/memory/logs/"; do
61	if ! grep -qF "$pattern" "$ORACLE_ROOT/.gitignore" 2>/dev/null; then
62	MISSING_IGNORES="$MISSING_IGNORES\n ❌ Missing: $pattern"
63	fi
64	done
65
66	if [ -n "$MISSING_IGNORES" ]; then
67	echo "📋 .gitignore gaps:$MISSING_IGNORES"
68	else
69	echo "✅ .gitignore covers essentials"
70	fi
71	```
72
73	---
74
75	## Step 2: Golden Rules Compliance
76
77	Read CLAUDE.md and verify the 5 Principles + Rule 6 are present:
78
79	```bash
80	echo "📜 Checking Golden Rules..."
81	CLAUDE_MD="$ORACLE_ROOT/CLAUDE.md"
82	```
83
84	Check for:
85
86	\| Rule \| Search Pattern \| Required \|
87	\|------\|---------------\|----------\|
88	\| Nothing is Deleted \| `Nothing is Deleted` \| Yes \|
89	\| Patterns Over Intentions \| `Patterns Over Intentions` \| Yes \|
90	\| External Brain \| `External Brain` \| Yes \|
91	\| Curiosity Creates \| `Curiosity Creates` \| Yes \|
92	\| Form and Formless \| `Form and Formless` \| Yes \|
93	\| Rule 6 (Transparency) \| `Oracle Never Pretends` \| Yes \|
94	\| No force push \| `force` or `--force` in golden rules \| Yes \|
95	\| No rm -rf \| `rm -rf` in golden rules \| Yes \|
96	\| No secrets \| `secrets` or `.env` in golden rules \| Yes \|
97
98	Report missing principles as warnings.
99
100	---
101
102	## Step 3: Brain Structure Audit
103
104	Verify ψ/ directory structure:
105
106	```bash
107	echo "🧠 Checking brain structure..."
108	PSI_REAL=$(readlink -f "$PSI" 2>/dev/null \|\| echo "$PSI")
109
110	for dir in inbox memory writing lab learn active archive outbox; do
111	if [ -d "$PSI_REAL/$dir" ]; then
112	COUNT=$(find "$PSI_REAL/$dir" -type f 2>/dev/null \| wc -l)
113	echo " ✅ ψ/$dir/ ($COUNT files)"
114	else
115	echo " ⚠️ ψ/$dir/ missing"
116	fi
117	done
118	```
119
120	### ψ/ Symlink Check
121
122	```bash
123	if [ -L "$ORACLE_ROOT/ψ" ]; then
124	TARGET=$(readlink "$ORACLE_ROOT/ψ")
125	echo " 🔗 ψ → $TARGET"
126	if [ ! -d "$TARGET" ]; then
127	echo " 🚨 Symlink target doesn't exist!"
128	fi
129	else
130	echo " 📁 ψ/ is a regular directory"
131	fi
132	```
133
134	---
135
136	## Step 4: Identity Verification
137
138	Check CLAUDE.md has required identity fields:
139
140	```bash
141	echo "🪪 Checking identity..."
142	```
143
144	\| Field \| Pattern \| Required \|
145	\|-------\|---------\|----------\|
146	\| Name \| `I am` or `name:` \| Yes \|
147	\| Human \| `Human:` \| Yes \|
148	\| Purpose \| `Purpose:` \| Yes \|
149	\| Born \| `Born:` \| Recommended \|
150	\| Theme \| `Theme:` \| Recommended \|
151	\| Node \| `Node:` \| For fleet oracles \|
152
153	---
154
155	## Step 5: Operational Checks
156
157	### Git Config
158
159	```bash
160	echo "⚙️ Checking git config..."
161	# Verify git user is set (not default)
162	GIT_USER=$(git config user.name 2>/dev/null)
163	GIT_EMAIL=$(git config user.email 2>/dev/null)
164	echo " User: $GIT_USER <$GIT_EMAIL>"
165
166	# Check for dangerous aliases
167	git config --get-regexp alias 2>/dev/null \| grep -E '(force\|reset.hard\|clean.-f)' && echo " ⚠️ Dangerous git aliases found"
168	```
169
170	### Installed Skills Check
171
172	```bash
173	echo "🔧 Checking installed skills..."
174	if [ -d "$ORACLE_ROOT/.claude/settings" ] \|\| [ -f "$

People who liked this also viewed

6 picks

Type