octocode-harness-status — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited octocode-harness-status (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Audit every agent vendor on this machine, measure skill context budget, and expose one-click removal — all in a local interactive browser dashboard.
One command. That's it.
node skills/octocode-harness-status/scripts/build_harness.mjsThe script:
| Flag | Description | Default |
|---|---|---|
--port <n> | HTTP server port | auto (random free port) |
--no-open | Generate but don't open browser | opens |
--timeout <s> | Server auto-shutdown after N seconds | 300 |
--help | Print usage | — |
| Section | What it shows |
|---|---|
| Summary bar | Vendor count, total MCPs, total skills, auth status |
| Per-vendor cards | MCP list + Skills list, each with a ✕ remove button |
| CLI inventory | Version, auth state, rate limits for each CLI |
| Context budget | Total SKILL.md bytes per vendor, estimated tokens, % of agent context window, colour-coded health |
| Colour | Budget used | Meaning |
|---|---|---|
| 🟢 Green | < 5 % | Lean — almost no context overhead |
| 🟡 Yellow | 5–15 % | Moderate — normal for active setups |
| 🟠 Orange | 15–30 % | Heavy — consider trimming inactive skills |
| 🔴 Red | > 30 % | Critical — may crowd out useful context |
Context window baselines: Claude 200 k tokens · GPT-4o 128 k tokens · Gemini 1 M tokens · Codex 32 k tokens.
rm -rf) from the vendor's skills directoryBoth actions prompt for confirmation in the dashboard before writing to disk.
Read-only configs: TOML (Codex) and YAML (Goose) configs are parsed for display but never written — their MCP rows show a 🔒 and have no edit/remove buttons, so the dashboard can't corrupt non-JSON files.
Safety: the local server only accepts same-origin requests (no website you visit can drive it), rejects MCP/skill names containing path separators or .., and refuses to delete anything outside your home directory or any directory.
/ — focus the filter boxEsc — close any open modalThe script prints the dashboard URL and keeps the server alive for --timeout seconds (default 5 min). Hit Ctrl-C or wait for auto-shutdown.
| Situation | Behaviour |
|---|---|
| Config file missing | Vendor shown as "not configured" — no error |
| Skills directory missing | Skills count 0 — no error |
| CLI not installed | CLI row shown as "not installed" |
| GitHub rate limit API unreachable | Rate limit shown as "N/A" |
| Port in use | Auto-increments to next free port |
| TOML (Codex) / YAML (Goose) config | Parsed read-only for display; MCP rows are locked (no edit/remove) |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.