harness-audit
starsforks
How to install harness-audit?
xwtro0tk1t-cloud/harness/harness-audit
$npx -y skills add xwtro0tk1t-cloud/harness --skill harness-audit--- description: Triggered when the user says "harness audit", "project health check", "harness status", "check harness health", or "check project configuration". Scans the project's Harness configuration completeness and outputs a checklist + score + remediation suggestions. ---
SKILL.md
| 1 | # Harness Audit — Project Health Check |
| 2 | |
| 3 | --- |
| 4 | description: Triggered when the user says "harness audit", "project health check", "harness status", "check harness health", or "check project configuration". Scans the project's Harness configuration completeness and outputs a checklist + score + remediation suggestions. |
| 5 | --- |
| 6 | |
| 7 | ## Behavior |
| 8 | |
| 9 | Perform a comprehensive health check on the current project, outputting a checklist-format report. |
| 10 | |
| 11 | --- |
| 12 | |
| 13 | ## Checklist |
| 14 | |
| 15 | ### A. Infrastructure (max 25 points) |
| 16 | |
| 17 | | # | Check Item | Points | Method | |
| 18 | |---|-----------|--------|--------| |
| 19 | | A1 | CLAUDE.md exists and ≤120 lines | 10 | Read file, check line count | |
| 20 | | A2 | docs/ directory complete (architecture/ + conventions/ + implementation/) | 10 | Check directory existence | |
| 21 | | A3 | .harness/ directory exists (agents/ + templates/) | 5 | Check directory existence | |
| 22 | | A4 | .claude/settings.json exists with hooks configured | 5 | Read and parse JSON | |
| 23 | |
| 24 | ### B. Skill Ecosystem (max 30 points) |
| 25 | |
| 26 | | # | Check Item | Points | Method | |
| 27 | |---|-----------|--------|--------| |
| 28 | | B1 | Three core Skills installed (superpowers + planning-with-files + claudeception) | 15 | Scan ~/.claude/skills/ | |
| 29 | | B2 | Hooks correctly configured (SessionStart + UserPromptSubmit + PreToolUse + PostToolUse + Stop) | 10 | Read .claude/settings.json | |
| 30 | | B3 | Project security-review Skill generated | 5 | Scan ~/.claude/skills/security-review-skill-for-* | |
| 31 | |
| 32 | ### C. Bundled Skills (max 20 points) |
| 33 | |
| 34 | | # | Check Item | Points | Method | |
| 35 | |---|-----------|--------|--------| |
| 36 | | C1 | Skill factories installed (skill-creator + security-review-skill-creator) | 5 | Scan ~/.claude/skills/ | |
| 37 | | C2 | Security Skills installed (sca-ai-denoise + supply-chain-audit + skills-audit) | 5 | Scan ~/.claude/skills/ | |
| 38 | | C3 | Configurable Skill status (web-vuln-analyzer / android-vuln-analyzer) | 5 | Check installation + config files | |
| 39 | | C4 | Command Skills installed (harness-help + harness-audit + harness-quality-gate + harness-guide + harness-cleanup + harness-resume + harness-handoff) | 5 | Scan ~/.claude/skills/harness-* | |
| 40 | |
| 41 | ### D. Code Hygiene (max 25 points) |
| 42 | |
| 43 | | # | Check Item | Points | Method | |
| 44 | |---|-----------|--------|--------| |
| 45 | | D1 | No temp scripts in root directory (test_*.py / debug_*.py / fix_*.py) | 5 | Glob match | |
| 46 | | D2 | .env file not tracked by git | 5 | git ls-files --error-unmatch .env | |
| 47 | | D3 | No hardcoded secrets/tokens in tracked files | 5 | Grep common key patterns | |
| 48 | | D4 | docs/ has recent updates (within 30 days) | 5 | git log check | |
| 49 | | D5 | docs/ INDEX.md two-level structure complete (file-level + section-level ↳ prefix) | 5 | Read INDEX.md and check format | |
| 50 | |
| 51 | > **Remediation**: For temp files found in D1, suggest user runs **harness cleanup** for interactive archiving (never deletes, only moves to archive/). |
| 52 | |
| 53 | --- |
| 54 | |
| 55 | ## Output Format |
| 56 | |
| 57 | ``` |
| 58 | ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ |
| 59 | 🏥 Harness Project Health Report |
| 60 | ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ |
| 61 | |
| 62 | 📊 Total Score: XX / 100 |
| 63 | |
| 64 | A. Infrastructure [XX/25] |
| 65 | ✅ A1: CLAUDE.md exists (XX lines) |
| 66 | ❌ A2: docs/ missing pitfalls/ directory |
| 67 | ✅ A3: .harness/ complete |
| 68 | ⚠️ A4: settings.json missing Stop hook |
| 69 | |
| 70 | B. Skill Ecosystem [XX/30] |
| 71 | ✅ B1: 3/3 core Skills installed |
| 72 | ⚠️ B2: Missing PreToolUse hook |
| 73 | ❌ B3: No project security audit Skill generated |
| 74 | |
| 75 | C. Bundled Skills [XX/20] |
| 76 | ✅ C1: 2/2 Skill factories installed |
| 77 | ✅ C2: 3/3 security Skills installed |
| 78 | ⚠️ C3: web-vuln-analyzer installed but not configured |
| 79 | ✅ C4: 7/7 command Skills installed |
| 80 | |
| 81 | D. Code Hygiene [XX/25] |
| 82 | ❌ D1: Found 3 temp scripts in root directory |
| 83 | ✅ D2: .env not tracked |
| 84 | ✅ D3: No hardcoded secrets found |
| 85 | ⚠️ D4: docs/ not updated in over 30 days |
| 86 | |
| 87 | ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ |
| 88 | 🔧 Remediation Suggestions (by priority) |
| 89 | ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ |
| 90 | |
| 91 | 1. [High] Generate project security audit Skill |
| 92 | → Say "generate a security audit skill for this project" |
| 93 | |
| 94 | 2. [Medium] Add PreToolUse hook |
| 95 | → Add planning-with-files PreToolUse hook to .claude/settings.json |
| 96 | |
| 97 | 3. [Low] Clean up root directory temp scripts |
| 98 | → Move test_*.py to tests/ directory |
| 99 | ``` |
| 100 | |
| 101 | --- |
| 102 | |
| 103 | ## Scoring Guide |
| 104 | |
| 105 | | Score Range | Status | Recommendation | |
| 106 | |-------------|--------|---------------| |
| 107 | | 90-100 | 🟢 Healthy | Maintain good practices | |
| 108 | | 70-89 | 🟡 Good | Fix high-priority items | |
| 109 | | 50-69 | 🟠 Needs attention | Recommend completing infrastructure soon | |
| 110 | | <50 | 🔴 Needs repair | Recommend re-running `harness` initialization | |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
