/harness

Harness: Project Development Scaffold Meta-Skill

--- description: Use when the user wants to initialize a project development environment, establish a documentation system, set up an Agent Team, or says "harness", "project initialization", or "setup dev environment". Also automatically suggested at the first development session of a new project. ---

Overview

Harness is a project development scaffold meta-skill. When invoked, it automatically: analyzes the project → installs/configures the shared Skill ecosystem → generates a documentation system → establishes an Agent Team → injects secure development standards.

**Core principles**: 1. **Assume beginner user** — Provide complete guidance, never skip steps 2. **Skills must be triggerable** — Not just installed, but hooks configured to ensure effectiveness 3. **Dual-layer enhancement + Skill auto-matching** — Hook (system-level) + CLAUDE.md (rule-level), Skill description assists automatic triggering 4. **Project-specific Skills stored separately** — Experience accumulated during development is saved to the project-level `.claude/skills/` 5. **Built-in security standards** — High-risk CWE defense + Agent behavior red lines

---

Workflow (7 Steps)

Step 1: Project Analysis

Scan the project root directory, determine the project type, and branch accordingly:

1. **Determine project type**: Existing project (has source files) vs new project (empty directory / only README) 2. **Language and framework detection**: Check package.json / go.mod / Cargo.toml / pyproject.toml / pom.xml etc. Identify primary language and framework. Record tech stack (used in Step 5 for tailoring coding conventions). New project: ask user for target tech stack 3. **Project structure analysis**: List top-level directories, identify core directories (src/ / cmd/ / internal/ etc.), check Dockerfile / CI configuration 4. **AI tool detection**: Detect current runtime → determine instruction file name (Claude Code→CLAUDE.md / Cursor→.cursorrules / Windsurf→.windsurfrules / Cline→.clinerules / Copilot→.github/copilot-instructions.md / Aider→CONVENTIONS.md / Continue→.continuerules / Devin→devin.md / Generic→AGENT.md). In subsequent steps, "CLAUDE.md" is replaced with the detected instruction file 5. **Existing documentation check**: Instruction file / docs/ / .harness/ / .claude/settings.json 6. **Output project profile** (confirm with the user): Language / Framework / Build tool / Test framework / Deployment method / Core modules

**Special handling for new projects**: Generate skeleton docs + `<!-- TODO: fill in -->` placeholders. Prompt the user: "After the project code is ready, re-run harness to supplement the documentation content"

---

Step 2: Skill Ecosystem Installation & Hook Configuration (Core Step)

This is the most important step in Harness. It is not just about installing skills — hooks must also be configured to ensure they actually take effect.

**2.1 Check Installed Skills**: Scan `~/.claude/skills/`, compare against `references/skill-ecosystem.md` to display installation status ([✅/❌] for each core Skill)

**2.2 Install Bundled Skills**: Batch install `bundled-skills/` to `~/.claude/skills/` via symlink. Skills requiring additional configuration (web-vuln-analyzer needs Docker + API / android-vuln-analyzer needs toolchain / skills-audit optional API key) are guided interactively. Full list in `references/skill-ecosystem.md`

**2.2b Install External Core Skills**: Installation commands for superpowers / planning-with-files / claudeception are in `references/skill-ecosystem.md`. Plugin installs auto-register hooks; fallback git clone requires manual configuration

**2.3 Configure Hooks**:

• Core Skill hook mechanisms: superpowers SessionStart / planning-with-files 4 hooks / claudeception UserPromptSubmit — see `references/skill-ecosystem.md` for details
• **Enterprise Security Gate Hooks** (optional): pre-commit secret check / commit format validation / dangerous command interception / code write security scan — ask user whether to enable. See `references/hook-scripts.md` for details

**2.4 Skill Factory Usage Guide**: Show user usage scenarios for /claudeception, skill-creator, security-review-skill-creator, superpowers:writing-skills (3-line overview)

**2.5 Project-Specific Skill Check**: Check `.claude/skills/` and `~/.claude/skills/security-review-skill-for-*`, prompt to generate if no match found

**2.6 Dev Tool Detection**:

• Detect code-review-graph:

  python -c "import code_review_graph.tools" 2>/dev/null

• Available → `[✅] code-review-graph` — Register graph + explore skills, inject knowledge graph rules into CLAUDE.md
• Not available → `[❌] code-review-graph — pip install code-review-graph` (optional install)
• After CRG installed → prompt `/graph build` to build the current project's graph
• Regardless of CRG availability → unconditionally register design-review + ai-implementation-integrity

---

Step 3: Documentation System Generation (Deep Code Analysis)

**You must actually read the code — do not rely solely on CLAUDE.md/README.** Refer to `references/doc-templates.md`.

**3.0 Information Gathering** (MUST be completed before writing any documentation): Dispatch 3 Agents in parallel to gather core business analysis, frontend + infrastructure analysis, and history + documentation + test analysis. Collection points: application entry points, data models, configuration, auth, core business logic, API endpoints, frontend routing, deployment config, build scripts, git history, test coverage

**All docs/ content must come from the above gathering results — never fabricate content.** Mark uncertain content with `<!-- TODO: verify from code -->`

**3.1 AI Instruction File (Slim Index, ≤120 lines)**: Generate the corresponding instruction file based on the AI tool detected in Step 1. Use the `templates/claude-md-index.md` template. Content includes: one-line project description / docs/ navigation / common