Skills
Audit of 246 agent-harness repos found only 4.4% of security rules in public .claude/ files have an enforcement mechanism
François Zaninotto's 24 Sep audit of 246 open-source harness repos and 57 publications found that 60% of the harnesses have neither tests nor evals, and that only 4.4% of the security rules written in public .claude/ directories are backed by an executable guard. It collects cited results that the same model scored 68-88% across eight harnesses, that machine-generated context files lowered success while human-written ones added about 4%, and that Vercel's agent went from 80% to 100% success on half the tokens after dropping 80% of its tools. Its main recommendation is to turn every prose rule that matters into a hook or script and to keep a decision record with an expiry condition for each control.
↳ Follow the thread