Skip to content
Back to skills

Docs

ASecurity

Install and orientation for the `cowork-harness` companion skill — the thing that lets Claude Code drive the harness for you, instead of you typing CLI commands. **This page is install-only.** The canonical *usage* reference is the skill itself ([`SKILL.md`](../.claude/skills/cowork-harness/SKILL.md) and its `references/`), which is what an agent loads when it invokes the skill. - **Running the CLI by hand instead?** → [docs/cli.md](./cli.md) - **Wiring it into CI?** → [docs/ci.md](./ci.md) ---

  • 2 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added October 3, 2026
ai-agentsgoshellbashnodedockergit

Works with

  • claude code
  • claude desktop
  • cursor
  • cli

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 17 files and shows the line behind each finding

Scanned October 3, 2026

npx -y skills add yaniv-golan/cowork-harness --skill docs --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Docs?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Docs
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/yaniv-golan-docs/badge)](https://www.skillsdirectory.com/skills/yaniv-golan-docs)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
# The companion skill

Install and orientation for the `cowork-harness` companion skill — the thing that lets Claude Code
drive the harness for you, instead of you typing CLI commands.

**This page is install-only.** The canonical *usage* reference is the skill itself
([`SKILL.md`](../.claude/skills/cowork-harness/SKILL.md) and its `references/`), which is what an agent
loads when it invokes the skill.

- **Running the CLI by hand instead?** → [docs/cli.md](./cli.md)
- **Wiring it into CI?** → [docs/ci.md](./ci.md)

---

## Install

This repo ships a **companion skill** (`.claude/skills/cowork-harness/`) that teaches an agent how to drive the harness — author scenarios, pick a fidelity tier, script answers, place assertions in the right CI lane, and avoid the "✓ passed ≠ correct" traps. **This is independent of the CLI install above** — `npm install -g cowork-harness` puts the CLI on your `PATH` but does not register anything with Claude Code; to use the skill *inside* Claude Code, install it separately via the bundled marketplace, either as slash commands in an interactive session:

```text
/plugin marketplace add yaniv-golan/cowork-harness
/plugin install cowork-harness@cowork-harness
```

or their shell equivalents (e.g. in a non-interactive setup script):

```bash
claude plugin marketplace add yaniv-golan/cowork-harness
claude plugin install cowork-harness@cowork-harness
```

The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@^4.2.1"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 22). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.

It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):

```bash
npx skills add yaniv-golan/cowork-harness --skill cowork-harness
```

(Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)

**What the marketplace install actually pulls:** only `.claude/skills/cowork-harness/` — SKILL.md +
`references/` + `scenario.py`/assertion keys, per `.claude-plugin/marketplace.json`'s `source`. SKILL.md is a
short entrypoint (routing, the false-green invariants, short workflows); the detail it routes to lives in
`references/`, which the agent reads on demand. Everything
else (the CLI, `docs/`, the worked examples, the pytest lane) arrives when the skill's first command
self-bootstraps `npx "cowork-harness@^4.2.1"`, which pulls the same npm package as a global install.

For the full package-contents table — what a global install gives you versus a source checkout — see
[docs/cli.md → What ships](./cli.md#what-ships). It is maintained there, once.

Files in this skill

  • README.md15.5 KB
  • boundary.md25.8 KB
  • chat.md10.8 KB
  • ci.md14.4 KB
  • companion-skill.md2.9 KB
  • cowork-spawn-contract-1.12603.1.md9.3 KB
  • critique.md56.4 KB
  • debugging.md27.2 KB
  • decider-dir.md15.2 KB
  • decisions/2026-07-07-verification-strictness-and-fidelity.md7.3 KB
  • decisions/README.md1 KB
  • discovery.md8.5 KB
  • eval.md28.8 KB
  • gotchas.md10.1 KB
  • invariants.md20.5 KB
  • maintenance.md50.2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.