harness-init
One-time, guided setup of the local agent-first coding harness — the polling loop, the deterministic dispatcher, its config, the AGENTS.md contract, and the worktree provisioning that makes per-feature worktrees runnable. Use when a developer wants to set up, bootstrap, install, or initialize the coding harness for the first time in a project.
74
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
The canonical home for this skill is harness-init in tdg-ninja/context-specs-factory-ai
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
In the build outer loop (`/loop 5m /poll-and-dispatch`), the workflow uses `gh pr view` and `gh pr comment/view` to read GitHub PR review/comment bodies, which are outsider-authored free text, as part of the convergence/feedback gating before the agent runs (`poll-and-dispatch.sh` reads `.reviews[]` and detects `REVIEW_CLEAN_MARKER` in PR comment bodies).
- Repository
- tdg-ninja/context-specs-claude-code
- Commit
3a7a725
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.