CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

chaos-code-risk-scan

Scan a source code repository for resilience risks that a Harness chaos experiment can prove (outbound calls without timeouts, retries without backoff, missing graceful shutdown, health checks that mask dependency state, unbounded queues and pools, local state), map each one to a generic SourceCode risk rule, and report them to Harness as a CodeRepository risk scan. Use when the user asks to scan a repo or service code for resilience or chaos risks, or wants code findings they can verify with chaos experiments. Do not use for manifest or pipeline risk scans (those run in Harness), to create or run chaos experiments (use chaos-experiment), or for security or code quality review. Trigger phrases: scan this repo for resilience risks, chaos code scan, find chaos-provable risks, code risk scan, resilience review of this service.

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced multi-phase workflow with real validation gates and feedback loops, backed by real one-level-deep references and executable scripts. The main weaknesses are moderate redundancy across Performance Notes/Troubleshooting and the phases, and an inline attach sub-flow that inflates the always-loaded body.

Suggestions

Trim Performance Notes to only the new information (timing facts, validator implementation notes) and rely on Phase 2/4/8 for the max-per-kind, diff, and service-reuse rules it currently repeats.

Move the 'Attach a discovered service' sub-flow (~50 lines) into a reference file such as references/attach-service.md, keeping a one-line pointer in the body, since it only runs when the user explicitly asks in a later turn.

State the reuse-a-service-on-every-branch rule once (Phase 8) and cross-reference it from Phase 2 and Troubleshooting instead of restating it in four places.

DimensionReasoningScore

Conciseness

The body is dense, operational, and never explains concepts Claude already knows, but the Performance Notes section restates rules already given in the phases ("--max-per-kind 80", the diff/skip logic, one-read-per-file), and the service-reuse-on-every-branch rule appears four times across Phase 2, Phase 8, Performance Notes, and Troubleshooting. This is more than zero trimmable redundancy (not a 5), but the rest is lean with no conceptual padding or fluff (better than the "some unnecessary explanation" of a 3).

4 / 5

Actionability

Fully executable guidance throughout: copy-paste commands with complete arguments ("python3 \"$SKILL_DIR/scripts/inventory.py\" --repo \"$REPO\" --out \"$TMP/inventory.json\" --max-per-kind 80 [--since COMMIT]"), exact MCP call shapes with filter bodies, a concrete dispositions.json example, URL-normalization rules, an identity regex, hard caps ("at most 8 findings per module and 100 per scan"), and a troubleshooting table mapping exact error strings to fixes.

5 / 5

Workflow Clarity

Ten clearly sequenced phases with hard validation gates ("It must exit 0 before you onboard or submit anything" for coverage.py; validate_evidence.py drops before Phase 9) and explicit feedback loops: read uncovered/badDispositions, add a finding or real disposition, rerun; fix dropped findings only when the reason is a genuine mistake. It also includes a baseline regression check, 404-baseline and 409-submit recovery, and confirm:true retry semantics — matching the checklist/feedback-loop anchor. The batch-operation cap does not apply because validation is present.

5 / 5

Progressive Disclosure

All three references exist, are one level deep, and are linked exactly where the relevant phase needs them (Phase 3 → failure-modes.md, Phase 5 → rule-authoring.md, Phase 6 → evidence-contract.md), and scripts are invoked rather than inlined. However, the ~50-line attach-a-discovered-service sub-flow — a separate user-initiated operation — and repeated onboarding normalization detail are inlined in a 430-line body that loads on every invocation; these are minor organization gaps rather than the cleanly split structure of the top anchor.

4 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: concrete capabilities with an enumerated risk catalog, an explicit Use-when clause with natural trigger phrases, third-person voice, and explicit do-not-use boundaries against the nearest competing skills. No changes needed.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions — "Scan a source code repository for resilience risks ... map each one to a generic SourceCode risk rule, and report them to Harness as a CodeRepository risk scan" — with a comprehensive enumerated catalog of the risk types targeted ("outbound calls without timeouts, retries without backoff, missing graceful shutdown, health checks that mask dependency state, unbounded queues and pools, local state"). Coverage of the skill's capabilities is comprehensive, exceeding the "minor gaps" level of a 4.

5 / 5

Completeness

It explicitly answers both questions: the "what" (scan for enumerated chaos-provable risk types, map to SourceCode rules, report as a CodeRepository risk scan) and the "when" ("Use when the user asks to scan a repo or service code for resilience or chaos risks ... Trigger phrases: ..."), plus negative scope. Voice is third person throughout, so no penalty applies. Both parts are concrete and explicit, matching the top anchor.

5 / 5

Trigger Term Quality

Explicit trigger phrases are natural user language with synonym coverage: "scan this repo for resilience risks, chaos code scan, find chaos-provable risks, code risk scan, resilience review of this service", plus "resilience or chaos risks" in the Use-when clause. This matches the comprehensive synonym coverage anchor rather than merely "a few natural terms missing".

5 / 5

Distinctiveness Conflict Risk

A clear niche (chaos-provable resilience risks in source code) with explicit negative boundaries: "Do not use for manifest or pipeline risk scans (those run in Harness), to create or run chaos experiments (use chaos-experiment), or for security or code quality review." The named sibling-skill disambiguation leaves minimal conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

harness/harness-ai

Path

plugins/claude/skills/chaos-code-risk-scan/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.