Individual skill

harness-threat-model

Enterprise-review-grade threat model from `harness threat-model {path}`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.

plugins/ruflo-metaharness/skills/harness-threat-model/SKILL.md

Read pinned source

Source commit 722232566ad1fc4e73ba4fefc46d77d380ce61ba

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 6, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 81,218
Repository last updated: Nov 7, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

swarm Repository topic
agentic-ai Repository topic
agentic-framework Repository topic
agentic-workflow Repository topic
autonomous-agents Repository topic
codex Repository topic
mcp-server Repository topic
multi-agent Repository topic
ai-assistant Repository topic
multi-agent-systems Repository topic
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 1,452 bytes

Read excerpt


The companion to `harness-mcp-scan` for enterprise security reviews.
Where mcp-scan is a per-server static lint, threat-model produces a
categorized report suitable for sharing with an InfoSec team.

## Algorithm

Implementation: [`scripts/threat-model.mjs`](../../scripts/threat-model.mjs).

1. Invoke the pinned `harness` binary (`metaharness@~0.4.1`, resolved from a
   local install or the one-time `~/.ruflo/metaharness-cache-<pin>` cache —
   never `@latest`): `harness threat-model <path> --json`.
2. Parse `{ worst, findings[] }`.
3. `--fail-on <severity>`: exit 1 when `worst >= fail-on`. Default `high`.