一键在 Manus 中运行任何 Skill

harness-audit

星标5

分支1

更新时间2026年4月13日 16:01

Audit the agent harness itself — CLAUDE.md, hooks, MCP configs, agent definitions, and permissions — for misconfigurations, injection risks, and security gaps. Use when the user asks to "audit my setup", "check my harness config", "is my agent config secure", "review my hooks", "check my MCP setup", or before trusting a new project's harness with autonomous work. Worth using on first clone of an unfamiliar repo, after adding new hooks or MCP servers, or when onboarding a new team member. Do NOT use for auditing project source code (use audit or tri-security), debugging workflow failures (use tri-debug or bugfix), or reviewing code changes (use tri-review).

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

5uck1ess

5uck1ess/devkit

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Harness Audit

Audit agent harness configuration for security and misconfiguration issues.

Invoke

Use the devkit_start tool with workflow: "harness-audit" and input: "{input}".

Then follow each step the engine returns. Call devkit_advance after completing each step. The engine controls step order, gates, and loops. Do NOT skip steps.

同仓库更多 Skills

同仓库

adr

5uck1ess/devkit

Generate Architecture Decision Records — use when asked to document a decision, create an ADR, record why we chose X, or capture architectural rationale.

2026-05-195

doc-gen

5uck1ess/devkit

Generate documentation for code — use when asked to document a module, generate API docs, create a README for code, or write reference documentation. Triggers the deterministic doc-gen workflow (analyze → generate via documenter agent → write).

2026-05-195

health

5uck1ess/devkit

Check devkit health — which external CLIs (codex, gemini, gh, rtk, sg, gcli) are installed, which agents are available, which skills are ready to use. Use when asked about devkit health, devkit status, "is devkit working?", "what's installed?", "what devkit capabilities do I have?", diagnosing devkit setup issues, or running /devkit:health. Read-only diagnostic, safe to auto-invoke.

2026-05-195

mega-pr

5uck1ess/devkit

Fan-out PR review that runs BOTH `/devkit:tri-review` AND `/pr-review-toolkit:review-pr` in parallel for maximum coverage, then presents unified results — this skill does not compete with its sub-skills, it delegates to both simultaneously. Use when the user asks for "mega PR review", "mega-pr", "mega review", "full PR review with everything", "both review tools", "maximum coverage review", or explicitly wants every available reviewer looking at a change at once (Claude + Codex + Gemini model diversity PLUS specialized aspect reviewers like silent-failure-hunter, type-design-analyzer, test-analyzer, code-reviewer). Worth the extra cost when: the PR is high-stakes and the user wants every angle covered, or before merging a critical or hard-to-revert change. Do NOT use when the user only wants one review system (use tri-review or pr-review-toolkit:review-pr directly). Do NOT use for routine code review where a single reviewer suffices. This is deliberate overkill for when you want absolutely everything.

2026-05-195

onboard

5uck1ess/devkit

Generate a codebase onboarding guide — use when asked to explain this codebase, help understand the architecture, give a tour of the repo, or onboard a new contributor. Triggers the deterministic onboard workflow (analyze structure → architect via researcher agent → write guide).

2026-05-195

pr-ready

5uck1ess/devkit

Full end-to-end PR pipeline — validate → necessity-check → lint (loop) → test (loop) → security scan → doc-check → changelog → create-pr → monitor reviews (loop). Takes a branch from "code done" to "merged" with every gate enforced. Use when the user asks to "submit a PR", "open a pull request", "ship this", "make this PR-ready", "finalize this branch", or wants the full pipeline run end-to-end with CI monitoring and reviewer-comment handling automated. Worth the ceremony when: lint and test gates must pass before the PR opens, docs need syncing alongside code (README, ROADMAP, SKILL.md, workflows), security scan is required, or the user wants reviewer comments automatically classified and responded to. Do NOT use for a quick commit+push+PR without gates — use `/commit-commands:commit-push-pr` for that lighter path. Do NOT use when already mid-PR and just handling existing review comments in isolation. Do NOT use on the main branch or with uncommitted changes — the validate step will block you. This is devkit

2026-05-195

name

harness-audit

description

Harness Audit

Audit agent harness configuration for security and misconfiguration issues.

Invoke

Use the devkit_start tool with workflow: "harness-audit" and input: "{input}".

Then follow each step the engine returns. Call devkit_advance after completing each step. The engine controls step order, gates, and loops. Do NOT skip steps.