harness-engineering

The name/description match the actual instructions: audit a repo, add repo-local docs, create executable checks, and wire CI. There are no unrelated requested credentials, binaries, or config paths that don't belong to this task.

SKILL.md stays within scope: it instructs the agent to read repo docs, add artifacts, create checks, and run a local validation command. Two points to note: (1) it recommends using the bun tool for lightweight governance scripts and suggests running `bun run template:check` — but the skill does not declare bun as required, so runtime may fail if bun is not present; (2) the instructions expect the agent to modify the repository and wire CI pipelines, which is appropriate for the purpose but is an action that should be reviewed by a human before merging or pushing.

This is an instruction-only skill with no install spec and no code files — lowest-risk installation footprint. Nothing will be downloaded or executed by the platform as part of an install.

The skill requests no environment variables, credentials, or config paths. The guidance to use local tooling and CI is proportional to its goal and does not ask for unrelated secrets.

The skill is not always-on and declares default model invocation behavior. agents/openai.yaml sets policy.allow_implicit_invocation: true, which permits implicit/autonomous invocation. That is coherent with an agent-facing skill but means the skill can be invoked by the model without an explicit user button press; combine this with the fact the skill edits repos and wires CI — you may want to control invocation or require human review of changes.