harness-bootstrap

59 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.

By nguyenhx2/agent-harness-bootstrap (GitHub) · coding · 11 stars · scanned at commit 67def2e

Bootstraps or standardizes the AI-agent harness for a repo - analyzes the existing source first, then generates the .claude folder (agents with explicit model/effort/tool budgets, path-scoped rules, commands, hooks, settings.json), the docs tree and AGENTS.md + CLAUDE.md, so one main session works every change at the process it needs, with read-only reviewers as the required gate on risky ones. Covers code repos and repos dedicated to research, strategy or documentation, plus a read-only audit …

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

The author does not mention this.

Found in 13 places.

harness-bootstrap/CHANGELOG.md, line 62`npx skills add`, and what it runs, sends and fetches.
harness-bootstrap/README.ja.md, line 20npx skills add nguyenhx2/agent-harness-bootstrap --skill harness-bootstrap
harness-bootstrap/README.md, line 21npx skills add nguyenhx2/agent-harness-bootstrap --skill harness-bootstrap

Show 10 more

harness-bootstrap/assets/claude/commands/skill-wire.md, line 28seat. Install-time review does not count - an update (`npx skills update`, or a marketplace
harness-bootstrap/assets/claude/hooks/README.md, line 38| `guard-deps` | `purpose_code` + `hooks_strict` | PreToolUse `Edit\|Write\|Bash\|PowerShell` | A hand edit of a lockfile; a download piped into an interpreter
harness-bootstrap/assets/claude/hooks/guard-deps.ps1, line 101Block 'go install/get with @latest resolves to whatever was published last. Pin a version (module@v1.2.3).'
harness-bootstrap/assets/claude/hooks/guard-deps.ps1, line 104Block 'cargo install --git without --rev or --tag builds whatever the default branch holds today. Add --rev <commit-sha>.'
harness-bootstrap/assets/claude/hooks/guard-deps.sh, line 180block "go install/get with @latest resolves to whatever was published last. Pin a version (module@v1.2.3)."
harness-bootstrap/assets/claude/hooks/guard-deps.sh, line 183block "cargo install --git without --rev or --tag builds whatever the default branch holds today. Add --rev <commit-sha>."
harness-bootstrap/commands/skill-wire.md, line 33seat. Install-time review does not count - an update (`npx skills update`, or a marketplace
harness-bootstrap/reference/skill-discovery.md, line 29Install: `npx skills add <owner/repo>@<skill>` into `.claude/skills/` (project scope, never `-g`).
harness-bootstrap/reference/skill-discovery.md, line 142wire time, because install-time review does not cover a later update (`npx skills update`, or a
README.md, line 73npx skills add nguyenhx2/agent-harness-bootstrap --skill harness-bootstrap --skill spec-builder

Reads your saved credentials, such as SSH keys or .env files

The author does not mention this.

Found in 7 places.

harness-bootstrap/CHANGELOG.md, line 94- The file name ended only at a space, a quote, `;` or `&`, so `cat .env|base64`,
harness-bootstrap/CHANGELOG.md, line 95`cat .env>x`, `(cat .env)` and `cat {.env,x}` were allowed. It now ends at any character a
harness-bootstrap/assets/claude/hooks/protect-secrets.ps1, line 31$secretPattern = '(^|/)\.env(\.[^/]+)?$|(^|/)(secrets?|credentials?)/|\.(pem|key|pfx|p12|ppk|asc|gpg)$|service[-_]?account.*\.json$|(^|/)id_(rsa|dsa|ecdsa|ed255

Show 4 more

harness-bootstrap/assets/claude/hooks/protect-secrets.sh, line 82secret_pattern='(^|/)\.env(\.[^/]+)?$|(^|/)(secrets?|credentials?)/|\.(pem|key|pfx|p12|ppk|asc|gpg)$|service[-_]?account.*\.json$|(^|/)id_(rsa|dsa|ecdsa|ed25519
harness-bootstrap/assets/scripts/env-read.py, line 219merged = dict(os.environ)
harness-bootstrap/scripts/port.py, line 516("shell", {"command": "cat .env", "cwd": rcwd}, "deny"),
README.md, line 123past: `.env` followed by a pipe, a redirect or a bracket (`cat .env|base64`), names the shell

Connects to the internet

This is disclosed by the author in the skill's SKILL.md or README.

Found in 29 places.

harness-bootstrap/README.ja.md, line 38自身の `WebSearch` を使うだけです。インストールするフックはネットワークに接続しません。
harness-bootstrap/README.md, line 38- **Fetches:** only through the agent's own `WebSearch`, when audit mode dates its baseline or
harness-bootstrap/assets/claude/hooks/README.md, line 36| `guard-egress` | `hooks_strict` | PreToolUse `Bash\|PowerShell\|WebFetch`, PostToolUse `WebFetch` | Blocks a shell upload (curl `-d/-F/-T/--json`, `-X POST`;

Show 17 more

harness-bootstrap/assets/claude/hooks/README.md, line 40| `retry-budget` | `long` | PostToolUseFailure and PreToolUse, `Bash\|PowerShell\|Edit\|MultiEdit\|Write\|WebFetch` | Counts consecutive IDENTICAL failures of o
harness-bootstrap/assets/claude/hooks/guard-deps.ps1, line 55if ($null -ne $fc -and -not ($fc -match '(curl|wget|iwr|irm|Invoke-WebRequest|Invoke-RestMethod)' -or $fc -match '(iex|Invoke-Expression)' -or $fc -cmatch '(^|[
harness-bootstrap/assets/claude/hooks/guard-deps.ps1, line 87if ($cmd -match '(curl|wget|iwr|irm|Invoke-WebRequest|Invoke-RestMethod)[^|]*\|\s*(sudo\s+)?(sh|bash|zsh|dash|python3?|node|perl|ruby|iex|Invoke-Expression|pwsh
harness-bootstrap/assets/claude/hooks/guard-deps.ps1, line 90if ($cmd -match '(iex|Invoke-Expression)\s*\(?\s*\(?\s*(irm|iwr|Invoke-RestMethod|Invoke-WebRequest|New-Object)') {
harness-bootstrap/assets/claude/hooks/guard-deps.sh, line 165if printf '%s' "$cmd" | grep -Eiq '(curl|wget|iwr|irm|Invoke-WebRequest|Invoke-RestMethod)[^|]*\|[[:space:]]*(sudo[[:space:]]+)?(sh|bash|zsh|dash|python3?|node|
harness-bootstrap/assets/claude/hooks/guard-deps.sh, line 168if printf '%s' "$cmd" | grep -Eiq '(iex|Invoke-Expression)[[:space:]]*\(?[[:space:]]*\(?[[:space:]]*(irm|iwr|Invoke-RestMethod|Invoke-WebRequest|New-Object)'; t
harness-bootstrap/assets/claude/hooks/guard-egress.ps1, line 96if ($tool -cne 'WebFetch') { exit 0 }
harness-bootstrap/assets/claude/hooks/guard-egress.ps1, line 112if ($tool -ceq 'WebFetch') {
harness-bootstrap/assets/claude/hooks/guard-egress.ps1, line 122[Console]::Error.WriteLine("BLOCKED by guard-egress: a WebFetch to '$h' (not on .claude/hooks/egress-allowlist) carries a $($q.Length)-character query string -
harness-bootstrap/assets/claude/hooks/guard-egress.sh, line 201[ "$tool" = "WebFetch" ] || exit 0
harness-bootstrap/assets/claude/hooks/guard-egress.sh, line 211if [ "$tool" = "WebFetch" ]; then
harness-bootstrap/assets/claude/hooks/guard-egress.sh, line 221echo "BLOCKED by guard-egress: a WebFetch to '$h' (not on .claude/hooks/egress-allowlist) carries a ${#q}-character query string - the shape of data being sent
harness-bootstrap/assets/claude/settings.json, line 199"matcher": "Bash|PowerShell|WebFetch",
harness-bootstrap/assets/claude/settings.json, line 232"matcher": "Bash|PowerShell|Edit|MultiEdit|Write|WebFetch",
harness-bootstrap/assets/claude/settings.json, line 265"matcher": "WebFetch",
harness-bootstrap/assets/claude/settings.json, line 312"matcher": "Bash|PowerShell|Edit|MultiEdit|Write|WebFetch",
harness-bootstrap/assets/references/models-and-tools.json, line 317"name": "WebFetch",

and 9 more places

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 47 places.

harness-bootstrap/SKILL.md, line 63python scripts/scaffold.py --target <repo> --vars vars.json --dry-run # review first
harness-bootstrap/assets/claude/hooks/README.md, line 46| `guard-config` | `hooks_strict` | ConfigChange `user_settings\|project_settings\|local_settings` | A mid-session settings change that sets `disableAllHooks`,
harness-bootstrap/assets/claude/hooks/README.md, line 219inline shells (`sh -c`, `bash -c`, `powershell -c`) are refused outright, because their output IS

Show 17 more

harness-bootstrap/assets/claude/hooks/registration.posix.json, line 9"command": "bash .claude/hooks/protect-adr.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 15"command": "bash .claude/hooks/guard-agent-scope.sh"
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 19"command": "bash .claude/hooks/guard-task-scope.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 25"command": "bash .claude/hooks/guard-board.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 36"command": "bash .claude/hooks/guard-main-commit.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 43"command": "bash .claude/hooks/check-commit-msg.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 55"command": "bash .claude/hooks/guard-main-commit.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 62"command": "bash .claude/hooks/check-commit-msg.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 74"command": "bash .claude/hooks/protect-secrets.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 85"command": "bash .claude/hooks/guard-destructive.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 96"command": "bash .claude/hooks/guard-agent-spawn.sh",
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 109"command": "bash .claude/hooks/specs-reminder.sh"
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 113"command": "bash .claude/hooks/graph-stale.sh"
harness-bootstrap/assets/claude/hooks/registration.posix.json, line 124"command": "bash .claude/hooks/agent-history.sh"
harness-bootstrap/assets/claude/hooks/registration.windows.json, line 9"command": "powershell -NoProfile -ExecutionPolicy Bypass -File .claude/hooks/protect-adr.ps1",
harness-bootstrap/assets/claude/hooks/registration.windows.json, line 15"command": "powershell -NoProfile -ExecutionPolicy Bypass -File .claude/hooks/guard-agent-scope.ps1"
harness-bootstrap/assets/claude/hooks/registration.windows.json, line 19"command": "powershell -NoProfile -ExecutionPolicy Bypass -File .claude/hooks/guard-task-scope.ps1",

and 27 more places

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Other copies in this repository

nguyenhx2/agent-harness-bootstrap has 2 more folders with a skill named harness-bootstrap. This page shows the lowest-scoring copy.

plugins/harness-bootstrap/skills/harness-bootstrap 59/100 · Review before installing
plugins/codex/harness-bootstrap/skills/harness-bootstrap 59/100 · Review before installing

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'harness-bootstrap' ] || [ -L ~/.agents/skills/'harness-bootstrap' ]; then echo 'A skill folder named harness-bootstrap already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/nguyenhx2/agent-harness-bootstrap' "$d" && git -C "$d" checkout --quiet '67def2e4083f86c03d77284746a959efbfe9a90d' -- 'harness-bootstrap' && mkdir -p ~/.agents/skills && cp -R "$d"/'harness-bootstrap' ~/.agents/skills/'harness-bootstrap' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'harness-bootstrap' ~/.claude/skills/'harness-bootstrap' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for nguyenhx2/agent-harness-bootstrap shows the score of its lowest-scoring skill.

SkillTrust badge for nguyenhx2/agent-harness-bootstrap

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/nguyenhx2/agent-harness-bootstrap.svg)](https://zalavijaysinh.github.io/skilltrust/repos/nguyenhx2/agent-harness-bootstrap/)

Score history

Date	Version	Score
2026-11-08	`67def2e`	95