create-service — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-service (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate Harness Service YAML and push to Harness via MCP.
serviceDefinition.type and manifest configuration:k8s/, kubernetes/, manifests/ with YAML files → Kubernetes with K8sManifestkustomization.yaml → Kubernetes with KustomizeChart.yaml, charts/, helm/ → NativeHelm with HelmCharttask-definition.json → ECS with EcsTaskDefinitionserverless.yml / template.yaml (SAM) → ServerlessAwsLambdafunction.json (Azure) → AzureWebApp.NET + Windows → WinRmSshcreate-pipeline/references/codebase-analysis.md Step 4 for the full decision treeDockerRegistry*.dkr.ecr.*.amazonaws.com → Ecrgcr.io / *-docker.pkg.dev → Gcr*.azurecr.io → Acrharness_create with resource_type serviceservice:
name: My Service
identifier: my_service
orgIdentifier: default
projectIdentifier: my_project
serviceDefinition:
type: Kubernetes # Kubernetes, NativeHelm, ECS, ServerlessAwsLambda, Ssh, WinRm, AzureWebApp, AzureFunction, CustomDeployment
spec:
artifacts:
primary:
primaryArtifactRef: docker_image
sources:
- identifier: docker_image
type: DockerRegistry
spec:
connectorRef: dockerhub
imagePath: myorg/myimage
tag: <+input>
manifests:
- manifest:
identifier: k8s_manifest
type: K8sManifest
spec:
store:
type: Github
spec:
connectorRef: github_connector
repoName: my-manifests
branch: main
paths: [manifests/]
variables:
- name: replicas
type: String
value: "3"serviceDefinition:
type: Kubernetes
spec:
artifacts:
primary:
primaryArtifactRef: main_image
sources:
- identifier: main_image
type: DockerRegistry
spec:
connectorRef: dockerhub
imagePath: myorg/api
tag: <+input>
manifests:
- manifest:
identifier: manifests
type: K8sManifest
spec:
store:
type: Github
spec:
connectorRef: github
repoName: k8s-manifests
branch: main
paths: [deploy/]serviceDefinition:
type: NativeHelm
spec:
artifacts:
primary:
primaryArtifactRef: chart
sources:
- identifier: chart
type: DockerRegistry
spec:
connectorRef: dockerhub
imagePath: myorg/api
tag: <+input>
manifests:
- manifest:
identifier: helm_chart
type: HelmChart
spec:
store:
type: Http
spec:
connectorRef: helm_repo
chartName: my-chart
chartVersion: <+input>
helmVersion: V3serviceDefinition:
type: Kubernetes
spec:
artifacts:
primary:
primaryArtifactRef: main_image
sources:
- identifier: main_image
type: DockerRegistry
spec:
connectorRef: dockerhub
imagePath: myorg/api
tag: <+input>
manifests:
- manifest:
identifier: kustomize
type: Kustomize
spec:
store:
type: Github
spec:
connectorRef: github
repoName: k8s-config
branch: main
folderPath: overlays/production
pluginPath: ""serviceDefinition:
type: ECS
spec:
artifacts:
primary:
primaryArtifactRef: ecr_image
sources:
- identifier: ecr_image
type: Ecr
spec:
connectorRef: aws_connector
region: us-east-1
imagePath: my-image
tag: <+input>
manifests:
- manifest:
identifier: task_def
type: EcsTaskDefinition
spec:
store:
type: Github
spec:
connectorRef: github
repoName: ecs-config
branch: main
paths: [task-definition.json]serviceDefinition:
type: ServerlessAwsLambda
spec:
artifacts:
primary:
primaryArtifactRef: s3_artifact
sources:
- identifier: s3_artifact
type: AmazonS3
spec:
connectorRef: aws_connector
region: us-east-1
bucketName: my-deployments
filePath: serverless-app.zip
manifests:
- manifest:
identifier: serverless_manifest
type: ServerlessAwsLambda
spec:
store:
type: Github
spec:
connectorRef: github
repoName: serverless-config
branch: main
paths: [serverless.yml]DockerRegistry - Docker Hub (connectorRef, imagePath, tag)Ecr - AWS ECR (connectorRef, region, imagePath, tag)Gcr - Google GCR (connectorRef, registryHostname, imagePath, tag)GoogleArtifactRegistry - Google Artifact Registry (connectorRef, region, repositoryName, package, version)Acr - Azure ACR (connectorRef, subscriptionId, registry, repository, tag)ArtifactoryRegistry - JFrog Artifactory (connectorRef, repository, artifactPath, repositoryFormat, tag)Nexus3Registry - Nexus (connectorRef, repository, artifactPath, repositoryFormat, tag)GithubPackageRegistry - GitHub Packages (connectorRef, packageType, org, packageName, version)AmazonS3 - S3 (connectorRef, region, bucketName, filePath)GoogleCloudStorage - GCS (connectorRef, project, bucket, artifactPath)CustomArtifact - Custom source (scripts, delegateSelectors, version)Call MCP tool: harness_create
Parameters:
resource_type: "service"
org_id: "<organization>"
project_id: "<project>"
body: <service YAML>List existing services:
Call MCP tool: harness_list
Parameters:
resource_type: "service"
org_id: "<organization>"
project_id: "<project>"CONNECTOR_NOT_FOUND - Create connector first or fix connectorRefDUPLICATE_IDENTIFIER - Service exists; use harness_update<+input> means the tag is provided at runtime~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.