Skip to content
Back to skills

Harbor

ASecurity

"Use Harbor to evaluate agents and language models in sandboxed

  • 247 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 8, 2026
devopspythonbashdockerapi

Works with

  • cli
  • api
  • mcp

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 20 files and shows the line behind each finding

Scanned September 8, 2026

npx -y skills add VectorSpaceLab/AREX-Skill --skill harbor --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Harbor?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Harbor
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/vectorspacelab-harbor/badge)](https://www.skillsdirectory.com/skills/vectorspacelab-harbor)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: harbor
description: "Use Harbor to evaluate agents and language models in sandboxed
  tasks, author benchmark datasets and verifiers, run map-reduce jobs, inspect
  trajectories and artifacts, publish results, or extend Harbor with custom
  integrations."
disable-model-invocation: true
metadata:
  disco-role: operating
license: Apache 2.0
---

# Harbor

Harbor is a Python framework and CLI for evaluating agents and language models
against task environments, building benchmark datasets, scaling trials across
sandbox providers, and generating rollouts for optimization. Use this skill for
**operating Harbor**, not for editing arbitrary repository code.

## First checks

Use a compatible Python installation (the inspected release is Harbor `0.22.0`,
which requires Python `>=3.12`) and verify the actual installation before
making version-sensitive claims:

```bash
python -m pip install harbor
harbor --version
harbor run --help
```

For a safe, no-network diagnostic of Harbor plus the optional first-party
packages, run [`scripts/check_install.py`](scripts/check_install.py). Read
[`references/troubleshooting.md`](references/troubleshooting.md) when import,
CLI, optional-extra, or provider setup fails.

## Route by task shape

- **Run an existing task, dataset, job, or trial:** read
  [`run-evaluate`](sub-skills/run-evaluate/SKILL.md). It covers agents, models,
  environments, concurrency, retries, resources, network, artifacts,
  multi-step sessions, and trajectory loading.
- **Create or validate tasks, datasets, adapters, verifiers, RewardKit checks,
  metrics, or registry packages:** read
  [`author-benchmarks`](sub-skills/author-benchmarks/SKILL.md).
- **Compile files into tasks and optionally aggregate map outputs:** read
  [`exec-map-reduce`](sub-skills/exec-map-reduce/SKILL.md). This is the
  experimental `harbor exec` workflow, not ordinary `harbor run`.
- **Inspect, compare, regrade, view, export, upload, or publish outcomes:**
  read [`analyze-publish`](sub-skills/analyze-publish/SKILL.md). Keep
  credentialed and mutating actions gated.
- **Implement custom agents, environments, bridges, plugins, MCP/skills
  injection, or optional provider integrations:** read
  [`integrations`](sub-skills/integrations/SKILL.md).

Start with the narrowest route. When a request spans routes, finish the safe
configuration or inspection prerequisite first and hand off the resulting
paths/config; do not duplicate sibling instructions.

## Core model

Harbor's operating objects are task → dataset → trial → job → result. A task
contains an instruction, environment, and verifier. A dataset groups tasks. An
agent performs a task inside an environment; a trial is one attempt; a job is a
parallel collection of trials. Artifacts, verifier rewards, logs, and native or
ATIF trajectories are persisted for later inspection. Read
[`references/architecture.md`](references/architecture.md) for the verified
relationships and config layering.

## Safety and evidence gates

Before a costly run, resolve the input path/package, agent and model, provider,
credentials, task count, attempts, concurrency, timeout/resource/network
policy, artifacts, and output directory. Use `--print-config` where available
and prefer a tiny local or install-only preflight. Do not treat a parsed config
as proof that Docker, a cloud provider, a GPU, Windows containers, a model API,
or a registry credential works. Do not disable verification to hide a malformed
task or verifier.

The generated references are self-contained and do not require the source
checkout. Read [`references/repo-provenance.md`](references/repo-provenance.md)
before deciding whether this graph is stale for a new Harbor release or
checkout. Router placement for managed repo-skill discovery is recorded in
[`references/repo-routing-metadata.json`](references/repo-routing-metadata.json).

Files in this skill

  • SKILL.md3.8 KB
  • references/architecture.md3 KB
  • references/repo-provenance.md2.3 KB
  • references/repo-routing-metadata.json527 B
  • references/troubleshooting.md5.8 KB
  • scripts/check_install.py2.5 KB
  • sub-skills/analyze-publish/SKILL.md4.7 KB
  • sub-skills/analyze-publish/references/analysis-viewer-hub.md4.9 KB
  • sub-skills/analyze-publish/references/parity-reporting.md3.7 KB
  • sub-skills/analyze-publish/references/publish-upload-versioning.md5.5 KB
  • sub-skills/analyze-publish/references/results-and-trajectories.md6.8 KB
  • sub-skills/analyze-publish/references/troubleshooting.md6.2 KB
  • sub-skills/analyze-publish/scripts/generate_parity_summary.py7 KB
  • sub-skills/author-benchmarks/SKILL.md12 KB
  • sub-skills/author-benchmarks/references/datasets-adapters.md7.8 KB
  • sub-skills/author-benchmarks/references/registry-publishing.md6.1 KB
  • sub-skills/author-benchmarks/references/task-format.md8.5 KB
  • sub-skills/author-benchmarks/references/troubleshooting.md8.4 KB
  • sub-skills/author-benchmarks/references/verifiers-rewardkit-metrics.md7.6 KB
  • sub-skills/author-benchmarks/scripts/validate_adapter.py34.6 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.