harness-eval

Deep-evaluate a single skill with static analysis and qualitative issue detection, both individually and in context of the full setup. Use when the user wants to check if a specific skill is worth keeping, well-built, or redundant.

Run deterministic static analysis on the full agent setup (CLAUDE.md, skills, commands, hooks, agents, MCP configs). 64 rules + system-level analysis (token budget, trigger overlaps, dependencies). No LLM. Use when the user wants a fast lint check, CI gate, or structural health report.

Full qualitative review of the agent setup. Reads every file, applies per-component rubrics, runs 21 cross-type optimization checks, and produces KEEP/REVIEW/REMOVE verdicts. Use when the user wants a deep review, redundancy check, or quality assessment of their setup.

Deep security audit of the agent setup. Runs all deterministic security rules (prompt injection, credential access, data exfiltration, obfuscation, reverse shells, AST behavioral analysis, taint tracking, MCP permission analysis, tool poisoning, YARA signatures, CVE lookups) plus LLM-based semantic security review. Use when the user asks about security, safety, wants to audit their setup, or needs a pre-deployment security check.

A skill that contains injection patterns for testing

Review code for issues

Run lint checks on the codebase

Review code changes for bugs, style issues, and best practices. Use when the user asks for a code review or before merging.

A skill shared between Claude Code and Cursor setups. Use when the user asks for help with testing.

A skill that references credential paths for testing

A skill that contains data exfiltration patterns for testing

Review code for bugs and style issues

Scan code for security vulnerabilities