/harness-threat-model
Enterprise-review-grade threat model from `harness threat-model <path>`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.
$ npx -y skills add ruvnet/claude-flow --skill harness-threat-model --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/harness-threat-model
Context preview
The summary Claude sees to decide when to auto-load this skill.
Enterprise-review-grade threat model from `harness threat-model <path>`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.
SKILL.md
harness-threat-model.SKILL.mdname: harness-threat-model
description: Enterprise-review-grade threat model from `harness threat-model <path>`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.
argument-hint: "[--path .] [--fail-on clean|low|medium|high] [--format table|json]"
allowed-tools: Bash
The companion to `harness-mcp-scan` for enterprise security reviews. Where mcp-scan is a per-server static lint, threat-model produces a categorized report suitable for sharing with an InfoSec team.
Algorithm
Implementation: [`scripts/threat-model.mjs`](../../scripts/threat-model.mjs).
1. Invoke the pinned `harness` binary (`metaharness@~0.3.0`, resolved from a local install or the one-time `~/.ruflo/metaharness-cache-<pin>` cache — never `@latest`): `harness threat-model <path> --json`. 2. Parse `{ worst, findings[] }`. 3. `--fail-on <severity>`: exit 1 when `worst >= fail-on`. Default `high`.
Severity rank
| Severity | Rank | |---|---:| | clean | 0 | | low | 1 | | medium | 2 | | high | 3 |
When to use
- Pre-launch review: include the JSON output in the release-readiness
packet sent to security.
- Periodic audit: schedule via the planned `oia-audit` background
worker (ADR-150 Phase 2) to detect MCP-surface drift.
Graceful degradation
Same pattern as the other skills: when `harness` is absent, emit `{ degraded: true }` and exit 0. ADR-150 architectural constraint.
Read more
name: harness-threat-model description: Enterprise-review-grade threat model from `harness threat-model <path>`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read. argument-hint: "[--path .] [--fail-on clean|low|medium|high] [--format table|json]" allowed-tools: Bash
The companion to `harness-mcp-scan` for enterprise security reviews. Where mcp-scan is a per-server static lint, threat-model produces a categorized report suitable for sharing with an InfoSec team.
Algorithm
Implementation: [`scripts/threat-model.mjs`](../../scripts/threat-model.mjs).
1. Invoke the pinned `harness` binary (`metaharness@~0.3.0`, resolved from a local install or the one-time `~/.ruflo/metaharness-cache-<pin>` cache — never `@latest`): `harness threat-model <path> --json`. 2. Parse `{ worst, findings[] }`. 3. `--fail-on <severity>`: exit 1 when `worst >= fail-on`. Default `high`.
Severity rank
| Severity | Rank | |---|---:| | clean | 0 | | low | 1 | | medium | 2 | | high | 3 |
When to use
- Pre-launch review: include the JSON output in the release-readiness
packet sent to security.
- Periodic audit: schedule via the planned `oia-audit` background
worker (ADR-150 Phase 2) to detect MCP-surface drift.
Graceful degradation
Same pattern as the other skills: when `harness` is absent, emit `{ degraded: true }` and exit 0. ADR-150 architectural constraint.
An agent meta-harness for Claude Code and Codex. Agent = Model + Harness. The model writes; the harness gives it tools, memory, loops, sandboxes, and controls so it can actually work.
Repo: ruvnet/claude-flow
Other skills on claude-flow.
- /agentdb-advanced
Master advanced AgentDB features including QUIC synchronization, multi-database management, custom distance metrics, hybrid search, and distributed systems integration. Use when building distributed AI systems, multi-agent coordination, or advanced vector search applications.
Open skill - /agentdb-learning
Create and train AI learning plugins with AgentDB's 9 reinforcement learning algorithms. Includes Decision Transformer, Q-Learning, SARSA, Actor-Critic, and more. Use when building self-learning agents, implementing RL, or optimizing agent behavior through experience.
Open skill - /agentdb-memory-patterns
Implement persistent memory patterns for AI agents using AgentDB. Includes session memory, long-term storage, pattern learning, and context management. Use when building stateful agents, chat systems, or intelligent assistants.
Open skill - /agentdb-optimization
Optimize AgentDB performance with quantization (4-32x memory reduction), HNSW indexing (150x faster search), caching, and batch operations. Use when optimizing memory usage, improving search speed, or scaling to millions of vectors.
Open skill - /agentdb-vector-search
Implement semantic vector search with AgentDB for intelligent document retrieval, similarity matching, and context-aware querying. Use when building RAG systems, semantic search engines, or intelligent knowledge bases.
Open skill - /agentic-jujutsu
Quantum-resistant, self-learning version control for AI agents with ReasoningBank intelligence and multi-agent coordination
Open skill