harness

Create and update Harness AI agent instances - standalone templates for agentic workflows in pipelines. Use when asked to create agent, update agent, modify agent spec, build autonomous systems, or work with AI agents.

Approve pending Harness STO security exemptions (waivers) at their current scope or elevate them to Project, Org, or Account scope. Users say "approve" for both in-scope approval and higher-scope elevation — do not require the word "promote". Supports approving one exemption or a mixed list where each row has a different approval scope. Default workflow lists pending exemptions in chat (paginated preview) so the user picks by row number — no copying from the Harness UI. Use when a user wants to approve, sign off on, or clear pending exemptions, waive approvals, org-wide approval, or account-wide approval. Trigger phrases: approve exempt, approve exemption, approve waiver, sign off exemption, clear pending exemption, approve for org, approve for account, org-wide approval, account-wide approval, pending exemptions.

Use when asked to set up PR attestation, install harness-scs attestation hook, configure agent attestor, troubleshoot why agent attestation isn't uploading, or reconfigure an existing attestation hook (different SCM, new cosign key, updated Harness identity). Trigger phrases: set up PR attestation, install harness-scs attestation hook, configure agent attestor, why isn't my agent attestation uploading, set up agent attestation, configure PR signing, install attestation hook, configure claude attestation.

Add an SLSA Verification (SlsaVerification) step to an existing Harness pipeline to verify SLSA provenance attestations and optionally enforce OPA policy sets on provenance data. Supports CI and CD (Deployment) including CI-only pipelines — append a Deploy stage via Phase 3b when verifying before deploy. Supports Docker, ECR, GCR, GAR, ACR, HAR, and Local artifacts. Only works with existing pipelines. Use when asked to verify SLSA, enforce SLSA policies, add SLSA verification step, validate SLSA attestation, or gate deploy on SLSA provenance. Trigger phrases: enforce SLSA, SLSA verification, verify SLSA, SLSA policy enforcement, SlsaVerification, verify SLSA attestation, add SLSA verify step.

Add a SLSA Generation step (YAML type: provenance) to an existing Harness pipeline to generate SLSA provenance and optionally attest with Cosign (keyless, key-based, or Vault). Supports container images (Docker, ECR, GCR, GAR, ACR, HAR) and Harness Local Stage artifacts. Place after image build/push; run sequentially after SBOM steps, not in parallel. Only works with existing pipelines. Use when asked to generate SLSA, add SLSA provenance, SLSA Generation step, attest SLSA, or configure SLSA Level 3 provenance in a pipeline. Trigger phrases: generate SLSA, SLSA generation, add SLSA step, SLSA provenance, attest SLSA, SlsaGeneration, provenance step, SLSA attestation, add provenance step.

Add an SBOM (Software Bill of Materials) generation step to an existing Harness pipeline using Harness SCS SscaOrchestration (SBOM Orchestration). Supports container images and code repositories. Sources: docker, ECR, GCR, GAR, ACR, Harness AR (har), repository, and local workspace. Syft or cdxgen, SPDX or CycloneDX, optional SBOM attestation. Only works with existing pipelines. Use when asked to create an SBOM, generate a bill of materials, add SBOM to a pipeline, scan a container image or repo for components, or set up SBOM Orchestration. Trigger phrases: create SBOM, generate SBOM, add SBOM step, SBOM for image, SBOM for repo, scan for dependencies, SBOM Orchestration, add Generate SBOM step.

Add an SBOM Policy Enforcement (SscaEnforcement / CdSscaEnforcement) step to an existing Harness pipeline to verify SBOM attestations and apply OPA SBOM policy sets. Supports CI, Security, and CD (Deployment) including CI-only pipelines — if no Deploy stage exists, add one via Phase 3b (service, environment, infra, containerized step group) then place CdSscaEnforcement before deploy. Supports container images and repositories from Artifact Registry, Third-Party registries (docker, ECR, GCR, GAR, ACR), and Git. Matches Pipeline Studio SBOM Policy Enforcement UI. Only works with existing pipelines (may append a Deploy stage). Use when asked to enforce SBOM policies, add SBOM policy enforcement, verify SBOM attestation in pipeline, or block non-compliant components. Trigger phrases: enforce SBOM, SBOM policy enforcement, SBOM policy step, verify SBOM policy, SscaEnforcement, add policy enforcement after SBOM.

Add an Artifact Signing (SscaArtifactSigning) step to an existing Harness pipeline to Cosign-sign container or local-stage artifacts with keyless, key-based, or Vault signing. Supports Third-Party registries (Docker, ECR, GCR, GAR, ACR), Harness Artifact Registry (HAR), and Harness Local Stage artifacts. Place after image build/push; optionally upload .sig to the registry. Only works with existing pipelines. Use when asked to sign artifacts, add artifact signing, Cosign sign image, attach signature to registry, or configure SscaArtifactSigning. Trigger phrases: sign artifact, artifact signing, sign image, Cosign sign, add signing step, SscaArtifactSigning, attach signature, sign container image, HAR signing.

Audit a single Harness Developer Hub documentation page for accuracy, completeness, and editorial quality. Produces a scored report (pass/fail) and optionally rewrites the page. Triggers: "audit [file-path]", "audit [url]", "doc audit", "check this doc", "score this page", "audit the oldest page in [module]", or any request to evaluate a single documentation page against the Harness quality rubric. Also triggers when the user provides a developer.harness.io URL and asks for feedback or a JIRA ticket. For a full audit that also crawls every sibling page in the section, use doc-section-audit instead.

Write, rewrite, or review a best-practices documentation page in any module so it reads like advice from an experienced practitioner, not a feature tour. Enforces the recommendation + rationale + consequence model and the must-not rules (no "What you will learn", no Troubleshooting, no concept dumps). Triggers: "best practices page", "X best practices", "write best practices for", "is this a good best practices page", "review this best practices doc", "score this best practices page", or any request to create or update a page whose job is to recommend what to do and warn what breaks if you do not.

Score every page in a Harness Developer Hub module for compliance with the Claude and cursor rules, doc-structure template, and HDH writing style. Produces a module-level compliance report ranked by severity. Triggers: "module audit [module]", "compliance check [module]", "score all docs in [module]", "doc-module-audit [module]", "doc-module-check [module]", or any request to audit quality or style compliance across all pages in a module.

Audit a Harness Developer Hub documentation page and its entire sibling section. Scores the target page, crawls every sibling in the same folder, produces a section-level verdict and consolidation plan, and outputs a JIRA ticket description and rewrite prompt. Triggers: "section audit [file-path]", "audit [module] section", "audit the full section", "doc section audit", or any request that calls for auditing a page AND its surrounding docs. For a single-page audit without section crawl, use doc-audit instead.

Rewrite a single Harness Developer Hub documentation page based on an existing audit report. Reads the audit findings and applies all suggested improvements to the page. Triggers: "rewrite [file-path]", "apply the audit", "fix the doc", "doc rewrite [file]", or any request to apply audit findings to a page. Requires a prior doc-audit report to exist. For section-wide rewrites, use doc-section-rewrite instead.

Apply a doc-section-audit report across an entire section in supervised phases. Reads the audit findings and executes structural changes (Phase 1), content rewrites (Phase 2), and redirect/cleanup work (Phase 3), pausing for a git diff review between each phase. Triggers: "section rewrite [audit-report]", "apply the section audit", "execute the rewrite plan", "doc section rewrite", or any request to apply a doc-section-audit report to files in the repo.

Identify the most overdue documentation in a module and recommend whether each candidate warrants a single-page audit or a full section audit. Produces a ranked triage report. Triggers: "audit check [module]", "what needs auditing in [module]", "find stale docs in [module]", "doc audit check [module]", "where should I start with [module] docs", or any request to prioritise which pages in a module to audit next.

Extended documentation review for non-Harness docs or when image/link/SEO validation is needed. Use for: external repos, README reviews, blog posts, tutorial audits where asset validation matters. Adds: image path/alt-text/freshness checks, cross-reference validation, factual verification via web search, SEO/AEO analysis, What-Why-How framework evaluation. For Harness DevHub docs, use doc-section-audit instead (includes Harness-specific scoring and JIRA generation).

Creates or updates pipeline step schemas in the harness-schema repository. ALWAYS use this skill when user mentions ANY of these: - Step operations: "create step", "add step", "new step", "update step", "modify step", "edit step", "implement step", "define step", "build step" - Schema files: "step-info.yaml", "step-node.yaml", "StepInfo", "StepNode", "step schema", "step definition", "step spec" - Stage availability: "add to stage", "enable in stage", "available in stage", "register step", "execution-wrapper-config" - Template support: "step template", "template_config.yaml", "enable as template" - JSON updates: "pipeline.json", "template.json", "add definition", "update schema" - Field work: "add field", "add property", "new field", "step property", "step field", "modify field" - Expression support: "runtime input", "JEXL", "expression support", "<+input>", "common-jexl" - Category mentions: "CD step", "CI step", "custom step", "FME step", "feature flag step", "approval step" If user is working with files

Create and update Harness AI agent instances - standalone templates used as building blocks in pipelines. Agents contain a single agent step with connector-driven architecture requiring llmConnector (LLM access) and optional mcpConnectors (GitHub, Slack, Harness platform). Supports runtime inputs and task/rules-based instruction. Use when asked to create an agent, update agent spec, modify agent configuration, automate tasks, perform agentic workflows, build autonomous systems, or work with AI agents. Trigger phrases: create agent, update agent, modify agent spec, AI agent, autonomous agent, agentic pipeline, automation task, automate workflow, Harness agent, code coverage agent, review agent, agentic task.