Auto harness engineering meta-repo: discuss → curate → bootstrap a context-engineered project for Claude Code, Cursor, Copilot, and other AI coding agents.
SaferSkills independently audited context-forge (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Auto-harness-engineering for AI coding agents. Turns a 5-minute project discussion into a fully context-engineered GitHub repository.
Announce at start: "Using context-forge to bootstrap a harness-engineered repo for your project." (Translate to the user's language — see "Language matching" below.)
Detect the user's language from their first message and respond in that language for ALL user-facing output (announce message, fixed questions, free discussion, Phase 3 proposal, Phase 4 prompts, Phase 6 hand-off). Code blocks, file paths, command names, and frontmatter keys stay in English. Catalog entry names (e.g., gstack-claude-toolkit) stay as-is.
If the user switches language mid-flow, switch with them. If unclear, ask once.
The example output blocks in this skill are written in English; translate them when speaking to the user.
Before doing anything else, verify ALL of these. If any fail, ask the user to fix and stop.
gh CLI is authenticated: gh auth statusExpected: a logged-in account.
CONTEXT_FORGE_PATH to their clone (default: C:/Git/context-forge or ~/code/context-forge): test -d "$CONTEXT_FORGE_PATH/catalog" && test -f "$CONTEXT_FORGE_PATH/sources/index.json"If CONTEXT_FORGE_PATH is not set, ask the user where their context-forge clone is and persist it for the session.
"$CONTEXT_FORGE_PATH/scripts/validate-catalog.sh"If any step fails: stop and report the exact command that failed. Do NOT proceed.
Ask these one at a time. Wait for each answer before asking the next.
After all 4 are answered, echo the answers back in a single short summary so the user can correct any.
After fixed questions, hold a focused conversation — one question per turn. Goal: understand goals, constraints, success criteria, and any domain knowledge that should land in docs/spec.md.
Stop asking when you can write all five bullets above. If you've asked more than 8 questions and still can't, summarize what you have and ask the user "anything else essential before we move on?"
Internally produce:
goal: ...
milestones: [..., ..., ...]
constraints: ...
domain: ...
avoid: ...Do NOT show this YAML to the user yet. It feeds Phase 3.
Read every catalog/*/*.md file's frontmatter from $CONTEXT_FORGE_PATH/catalog/. For each entry, decide whether it applies based on:
entry.domain overlaps with the user's project type, OR domain: [general] is present.when_to_use text describe this user's project? Use judgment.category: multi-agent only apply if Phase 1 Q4 was "yes".applies_to_files (e.g., [".cursorrules"]) and the user's stack doesn't use those files, skip it.Group results by category. Within each category, pick at most 3 (sort by priority field, fall back to alphabetical).
Show the user a single message structured like this:
Based on our discussion, I'll include these from the catalog:
CLAUDE.md (claude-md):
- karpathy-single-claude-md — Single careful CLAUDE.md
- gstack-claude-toolkit — Garry Tan 23-tool stack
Skills:
- superpowers-skills-pattern — Skills framework
- cursor-rules-pattern (you mentioned Cursor)
Spec-driven:
- github-spec-kit
MCP:
- mcp-server-bootstrap
Prompts:
- prompt-engineering-foundations
Anything to remove or any category you want me to add?Wait for user response. If they ask to remove items, drop them. If they ask for items in a category that has none matched, search the catalog directly for that category.
Ask in one message (multiple-choice + free-text):
Run these in order. After each command, confirm the expected output before proceeding to the next.
# 1. Create remote + clone
gh repo create "<USER>/<NAME>" --private --clone --add-readme=false # or --public
cd "<LOCAL_PATH>/<NAME>"
# 1b. Normalize local branch to `main` — Windows defaults to `master`, which
# mismatches the remote's expected `main` and causes `git push` to fail with
# "src refspec main does not match any". Idempotent on macOS/Linux.
git branch -M main
# 2. Make directory structure
mkdir -p docs/know-how .claude/skills .claude/agents .claude/rules
# 3. Copy chosen catalog entries
# For each <entry> in the user-confirmed list:
cp "$CONTEXT_FORGE_PATH/catalog/<category>/<entry>.md" \
"docs/know-how/<category>--<entry>.md"Then synthesize these top-level files (do not just copy from catalog — these are written from scratch using Phase 2 inputs):
avoid list), references to docs/know-how/*.md./skill references, no Claude Code specifics). Used by Cursor / Copilot / Codex.Then add boilerplate (only if catalog/boilerplate/<project-type>.md exists):
# Optional - copy project-type .gitignore etc. if present
cp "$CONTEXT_FORGE_PATH/catalog/boilerplate/<type>.gitignore" .gitignoreAlways-include minimal .gitignore:
.env
.env.local
node_modules/
.DS_Store
Thumbs.db
.vscode/
.idea/Commit and push:
git add .
git commit -m "초기 하네스 셋업 (context-forge)"
git push -u origin mainOptional — set repo description and topics from Phase 2 goal:
gh repo edit <USER>/<NAME> --description "<one-line goal>"
# topics: derived from project type and key tech wordsPrint a final message in this exact shape:
✅ Done. Your harness-engineered repo:
https://github.com/<USER>/<NAME>
local: <LOCAL_PATH>/<NAME>
Included from catalog (<N> entries):
<list>
Next steps:
cd <LOCAL_PATH>/<NAME>
claude # start a fresh session in the new repo
Tip: Edit docs/spec.md as your project evolves; CLAUDE.md/AGENTS.md should stay short.After printing, stop. Do not start working in the new repo from this session.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.