harness-engineering

Pre-generation security guidance for AI-generated code. Loads anti-pattern context on demand based on file type. Use whenever writing or editing source code, especially in Python, JavaScript, TypeScript, Go, Bash, Terraform, or SQL. The skill flags high-frequency vulnerability patterns before they ship: dependency risks (slopsquatting and confusion), cross-site scripting, hardcoded secrets, SQL injection, authentication failures, input validation gaps, command injection, missing rate limiting, data exposure through verbose errors or logs, and unsafe file upload handling.

SCAFFOLDED. Phase 4 copies the validated skill manifest from Mac. Content is byte-identical across platforms. Do not adopt until Phase 4 validates skill loading in Claude Code on Windows.

Use when about to register a new MCP server, add to mcpServers, or accept an MCP invocation from a cloned repo. Walks the pre-trust audit (license, source review, network egress, version pin, secret-handling) before the server reaches the tool pool. Closes the gap above ~/.claude/mcp.json that the SessionStart hook does not gate.

Use when asked whether to adopt a tool, library, plugin, skill collection, agent definition, hook library, or any external project as part of the Claude Code harness. Applies the foundation/03 two-stage methodology (pre-filter then deep-eval), produces a binary integrate / integrate-with-constraints / reject decision, and prevents evaluation theater by rejecting rubric scoring.