Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

publish-harness — measured AI agent skill | DecimalAI

ruvnet/publish-harness

NewSkillScoreMaintained

Publish a generated harness to npm — runs the smoke test, signs the witness manifest, and dispatches `npm publish --provenance` from your tagged release.

DevOpsby ruvnet

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/ruvnet-publish-harness/SKILL.md

decimalai skills pull ruvnet-publish-harness --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/ruvnet-publish-harness/SKILL.md https://app.decimal.ai/s/ruvnet-publish-harness/SKILL.md

Raw file: /s/ruvnet-publish-harness/SKILL.md ↗ · machine-readable summary at /s/ruvnet-publish-harness.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 2h ago

—-42% tokens0% turns91% of whole cases pass with skill (20/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	103%	0%
case-03	✗→✓	▲ Improved	-51%	0%
case-04	✗→✓	▲ Improved	-53%	0%
case-05	✗→✓	▲ Improved	-58%	0%
case-06	✗→✓	▲ Improved	-33%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

ruvnet / metaharness

.claude-plugin/skills/publish-harness/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

publish-harness

> Codex skill that runs the full smoke-test → witness-sign → npm publish pipeline for a generated harness.

What it does

Builds the harness with npm run build
Runs npm test to confirm green tests
Calls harness sign to produce a fresh witness manifest (requires WITNESS_SIGNING_KEY env)
Confirms harness verify accepts the freshly signed manifest
Either:

dry_run=true (default): runs npm publish --dry-run and reports tarball stats
dry_run=false: runs the real npm publish --provenance --access public

Usage from Codex

/publish-harness path=./my-harness
/publish-harness path=./my-harness dry_run=false

Equivalent CLI

bash
cd ./my-harness
npm run build
npm test
harness sign
harness verify
npm publish --provenance --access public

Required env

WITNESS_SIGNING_KEY — 64-hex-char ed25519 seed (fetch from GCP Secret Manager via harness secrets fetch WITNESS_SIGNING_KEY)
NPM_TOKEN — npm registry credential (Codex skill assumes the host has it set, or fetches via harness secrets fetch NPM_TOKEN)