--- description: Trigger when user says "harness cleanup", "cleanup temp files", "archive temp files", "clean up root junk", "project cleanup", "archive junk files". Scans project root for temp files, interactively archives to archive/ directory. NEVER deletes — only moves. Do NOT trigger for: de...
Full skill instructions
Scan project root directory only (not recursive) for temp/junk files. Interactively archive to archive/YYYY-MM-DD/.
Never deletes — only moves. Works with harness-audit (passive detection).
Project root directory only, no recursion.
archive/** .git/** node_modules/** venv/** .venv/**
dist/** build/** .harness/** __pycache__/**
.pytest_cache/** .mypy_cache/** .tox/** .eggs/** *.egg-info/**
archive*/ *_archive/ _archive*/
backup*/ *_backup/ _backup*/
old_*/ _old/ trash/ .trash/
.harness/cleanup-exclude-dirs (one glob pattern per line)debug_*.py fix_*.py tmp_* scratch_* wip_*.py
*.bak foo.py bar.py baz.py qux.py
scratch_*.md wip_* NOTES.md output.txt
Check pytest testpaths in official precedence order:
pytest.ini — testpaths settingpyproject.toml [tool.pytest.ini_options] — testpathstox.ini [pytest] — testpathssetup.cfg [tool:pytest] — testpathsAdditional signals (raise threshold to 20): noxfile.py exists / [tool.hatch.envs.*.scripts] contains pytest / Makefile has pytest target
Logic:
Use git status --porcelain -- "$file" | cut -c1-2 to detect file git state:
| Code | Meaning | Color | Interaction |
|---|---|---|---|
"" | clean_tracked | 🟡 Yellow warning | "File is committed, can git rm after archive" |
??" | untracked | 🟢 Green (primary target) | Archive directly |
M/M /MM | dirty_tracked | 🔴 Red warning | "Has uncommitted changes, consider committing first" |
A /AM | staged | 🔴 Red strong warning | "Already staged, need to unstage before archiving" |
| Other | other | 🔴 Red | "Unknown state, please confirm before proceeding" |
Important: Do NOT use git diff --quiet HEAD -- <file> — it returns 0 for untracked files (misclassifies primary targets as clean).
[Archive All] [Skip All] [Review One by One]git rm --cached <file>1. dirty-check via porcelain
2. mkdir -p archive/YYYY-MM-DD/
3. flock archive/.lock
4. mv -n <file> archive/YYYY-MM-DD/<file>
5. If mv -n fails (name collision) → retry <file>.1, <file>.2, ...
6. Release lock
7. Generate archive/YYYY-MM-DD/README.md manifest
# Archive YYYY-MM-DD
| File | Original Path | State |
|------|--------------|-------|
| debug_auth.py | ./debug_auth.py | untracked |
--- description: Triggered when the user says "harness help", "harness commands", "harness usage", "what commands are available", or "show harness commands". Displays the Harness command index, installed Skill inventory, and high-frequency scenario entry points. ---
生成安全审计 skill。两种模式：(1) 项目模式——根据项目文档生成定制化审计 skill；(2) 通用模式——仅指定语言+框架，从参考资料库生成通用审计 skill。当用户想创建安全审计 skill、生成审计规则、或提到"生成安全审计skill"、"创建code review skill"、"生成 Java 审计 skill"时使用。
--- description: Triggered when the user says "harness audit", "project health check", "harness status", "check harness health", or "check project configuration". Scans the project's Harness configuration completeness and outputs a checklist + score + remediation suggestions. ---
审计 Terraform / IaC 代码安全（AWS 基础设施）。检测硬编码凭据、过宽 Security Group(0.0.0.0/0)、IAM 权限过大(Action/Resource *)、S3 公开访问、RDS 未加密/公开、State 文件泄露、ECS/EKS 容器特权、CloudTrail/VPC FlowLog 缺失、不安全 Provider/Module 引用等。当审计 Terraform 代码、IaC 安全评审、AWS 云基础设施配置检查、GitOps 安全审计时使用。支持 HCL(.tf)、Terraform JSON、tfvars、Terragrunt(HCL) 代码。
多语言供应链投毒检测。支持 python（.pth投毒/setup.py hooks）、npm（postinstall hooks/eval混淆）、go（init() 后门/go:generate）、rust（build.rs）、ruby（extconf.rb）、java（Maven plugin/Gradle exec）、php（composer scripts）。当用户担心供应链安全、想检查依赖投毒、或提到 litellm/ua-parser-js/event-stream 等供应链攻击事件时使用。
--- description: Triggered when the user says "recommend skill", "which skill", "harness guide", "skill recommendation", "what skill should I use", or "suggest a skill". Matches the best Skill for the user's scenario, shows installation status and invocation method. ---
--- description: Trigger when user says "harness resume", "resume context", "recover context", "load context", "resume after compact", "I want to continue where I left off", "restore work context". Lightweight same-session context recovery after /compact. Do NOT trigger for: "continue writing X f...
Audit AI Agent skills for security vulnerabilities including malicious code, remote execution, credential leaks, and supply chain risks. Use when reviewing third-party skills, investigating suspicious behavior, or performing security assessments.
Dispatch an independent challenger agent to adversarially review a spec or implementation plan against the actual codebase. Catches hallucinated APIs, wrong field names, nonexistent files, and incorrect assumptions. Two modes: (1) spec review — verifies DB model fields, API paths, config attribut...
审计 Docker/容器部署安全。检测 Dockerfile、docker-compose.yml、Kubernetes manifests 中的安全问题：特权容器、root 运行、敏感挂载、资源无限制、密钥泄露、Base Image 不合规、网络暴露等。当审计容器配置、Docker 安全、K8s 部署安全、或检查基础设施安全时使用。支持 Dockerfile、docker-compose.yml、Kubernetes YAML、Helm charts。
SCA 漏洞 AI 降噪与风险优先级评估。对 Grype/Snyk/Xray 等 SCA 工具的漏洞发现进行多维度风险评估，按 P0-P3 分级，过滤噪音（DoS、本地提权、低影响信息泄露），聚焦真正可利用的高风险漏洞。当用户需要对 SCA 扫描结果降噪、漏洞优先级排序、或供应链风险评估时使用。
Graph-driven project understanding using code-review-graph (CRG). Query architecture, modules, callers/callees, impact radius, hotspots, execution flows, and search nodes. Use when: (1) brainstorming and need to understand project structure, (2) writing plans and need impact analysis, (3) user sa...
Generate, edit, and beat-sync AI video with leading models in one workspace.
The world's fastest calendar for remote work
Transform Your Design with AI Designer by ImgCreator.ai
Revolutionizing Video Production with AI-Powered Creativity
Extend an image past the frame and let AI fill the new aspect ratio.
Discover your celebrity doppelgänger with StarByFace!
ChainClarity explains 700+ crypto whitepapers in plain English, with layered summaries, comparisons, research tools, alerts, and a $4.99 Pro plan.
Opus.ai: Revolutionize Your Web Experience