xwtro0tk1t-cloud/harness
20 skills
$npx skills add xwtro0tk1t-cloud/harnessSkillInstalls
android-vuln-analyzerThis skill provides **three primary modes** for Android security testing:design-reviewDispatch an independent challenger agent to adversarially review a spec or implementation plan against the actual codebase. Catches hallucinated APIs, wrong field names, nonexistent files, and incorreexploreGraph-driven project understanding using code-review-graph (CRG). Query architecture, modules, callers/callees, impact radius, hotspots, execution flows, and search nodes. Use when: (1) brainstorming graphManage code knowledge graphs via code-review-graph (CRG). Build, update, and check status of project code graphs stored in .code-review-graph/graph.db. Use when: (1) user says "build graph", "update gharness--- description: Use when the user wants to initialize a project development environment, establish a documentation system, set up an Agent Team, or says "harness", "project initialization", or "setupharness-audit--- description: Triggered when the user says "harness audit", "project health check", "harness status", "check harness health", or "check project configuration". Scans the project's Harness configuraharness-cleanup--- description: Trigger when user says "harness cleanup", "cleanup temp files", "archive temp files", "clean up root junk", "project cleanup", "archive junk files". Scans project root for temp files,harness-guide--- description: Triggered when the user says "recommend skill", "which skill", "harness guide", "skill recommendation", "what skill should I use", or "suggest a skill". Matches the best Skill for theharness-handoff--- description: Trigger when user says "harness handoff", "handoff context", "new agent takeover", "full project context", "load all context", "crash recovery", "transfer context", "project overview harness-help--- description: Triggered when the user says "harness help", "harness commands", "harness usage", "what commands are available", or "show harness commands". Displays the Harness command index, instalharness-quality-gate--- description: Triggered when the user says "quality gate", "pre-commit check", "ready to commit", "check before commit", "run quality checks", or "done"/"complete" (Standard level auto-trigger). Exharness-resume--- description: Trigger when user says "harness resume", "resume context", "recover context", "load context", "resume after compact", "I want to continue where I left off", "restore work context". Lisca-ai-denoiseSCA 漏洞 AI 降噪与风险优先级评估。对 Grype/Snyk/Xray 等 SCA 工具的漏洞发现进行多维度风险评估，按 P0-P3 分级，过滤噪音（DoS、本地提权、低影响信息泄露），聚焦真正可利用的高风险漏洞。当用户需要对 SCA 扫描结果降噪、漏洞优先级排序、或供应链风险评估时使用。security-review-skill-creator生成安全审计 skill。两种模式：(1) 项目模式——根据项目文档生成定制化审计 skill；(2) 通用模式——仅指定语言+框架，从参考资料库生成通用审计 skill。当用户想创建安全审计 skill、生成审计规则、或提到"生成安全审计skill"、"创建code review skill"、"生成 Java 审计 skill"时使用。security-review-skill-for-docker审计 Docker/容器部署安全。检测 Dockerfile、docker-compose.yml、Kubernetes manifests 中的安全问题：特权容器、root 运行、敏感挂载、资源无限制、密钥泄露、Base Image 不合规、网络暴露等。当审计容器配置、Docker 安全、K8s 部署安全、或检查基础设施安全时使用。支持 Dockerfile、docker-compose.ymlsecurity-review-skill-for-terraform审计 Terraform / IaC 代码安全（AWS 基础设施）。检测硬编码凭据、过宽 Security Group(0.0.0.0/0)、IAM 权限过大(Action/Resource *)、S3 公开访问、RDS 未加密/公开、State 文件泄露、ECS/EKS 容器特权、CloudTrail/VPC FlowLog 缺失、不安全 Provider/Module 引用等。当审计 Terrskill-creatorCreate new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skilskills-auditAudit AI Agent skills for security vulnerabilities including malicious code, remote execution, credential leaks, and supply chain risks. Use when reviewing third-party skills, investigating suspicioussupply-chain-audit多语言供应链投毒检测。支持 python（.pth投毒/setup.py hooks）、npm（postinstall hooks/eval混淆）、go（init() 后门/go:generate）、rust（build.rs）、ruby（extconf.rb）、java（Maven plugin/Gradle exec）、php（composer scripts）。当用户担心供应链安全、想检查依web-vuln-analyzer> **Version 2.0 - AI Native Architecture** > > 你（Claude）直接决策，无需遵循复杂的规则路由。以下是参考指南。