harden — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited harden (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A codebase hardening plugin that audits your project for security vulnerabilities (OWASP Top 10:2025), debugging gaps, test coverage, robustness issues, and accessibility violations (WCAG 2.2). Works with any language. Compatible with both Claude Code and OpenCode.
It doesn't fix anything -- it produces a severity-ranked report with a remediation plan.
/harden launches up to 6 specialized agents that scan your codebase in parallel:
Each agent researches current (2025/2026) best practices online for every issue it finds, citing authoritative sources.
Limitations: Recon assumes standard directory naming conventions. The security agent does not flag legitimate systems programming patterns (DLL injection, hooking, direct memory access). The accessibility audit only runs on projects with web/UI components. All agents search for English-language patterns.
/harden # Full audit (all 6 agents)
/harden debug-only # Debugging & observability only
/harden security-only # Security only (OWASP 2025)
/harden test-only # Tests & build verification only
/harden robust-only # Robustness only
/harden a11y-only # Accessibility only (WCAG 2.2, web projects)
/harden src/auth # Full audit scoped to a directoryThe output is a single consolidated report containing:
file:line, description, OWASP/CWE/WCAG reference, researched best practice (with source URL), and suggested fix| Level | Meaning |
|---|---|
| CRITICAL | Will cause data loss, security breach, or crash in production |
| HIGH | Significant risk or major quality issue |
| MEDIUM | Should be fixed but not urgent |
| LOW | Minor improvement |
| INFO | Suggestion or observation |
git clone https://github.com/Calvin-LLC/claude-harden-plugin.git
cd claude-harden-plugin
claude plugin add .Or manually copy to ~/.claude/skills/harden/.
Copy the OpenCode-formatted files to your OpenCode config directory:
git clone https://github.com/Calvin-LLC/claude-harden-plugin.git
cp claude-harden-plugin/opencode/commands/harden.md ~/.config/opencode/commands/
cp claude-harden-plugin/opencode/agents/*.md ~/.config/opencode/agents/The OpenCode version uses @subagent references (e.g., @recon, @security-audit, @accessibility-audit) which map to the agent files in the agents/ directory.
├── SKILL.md # Claude Code orchestration (7-phase audit)
├── commands/
│ └── harden.md # Claude Code /harden command wrapper
├── agents/ # Claude Code agent definitions
│ ├── recon-agent.md
│ ├── debug-audit-agent.md
│ ├── test-runner-agent.md
│ ├── security-audit-agent.md
│ ├── robustness-audit-agent.md
│ └── accessibility-audit-agent.md
├── opencode/ # OpenCode-compatible versions
│ ├── commands/
│ │ └── harden.md # OpenCode /harden command (standalone)
│ └── agents/
│ ├── recon.md
│ ├── debug-audit.md
│ ├── test-runner.md
│ ├── security-audit.md
│ ├── robustness-audit.md
│ └── accessibility-audit.md
└── .claude-plugin/
└── plugin.json # Claude Code plugin manifestThe Claude Code and OpenCode versions share the same audit logic and checklists. They differ only in frontmatter format and agent invocation syntax.
Only run /harden on projects you trust. The audit reads arbitrary project files and passes their content to agent prompts. Malicious projects could attempt to manipulate agent behavior through crafted file contents.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.