hook-stocktake SKILL.md skillB
hook-stocktake from shimo4228/claude-harness is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add shimo4228/claude-harness/hook-stocktake@git:20261031.cac9d1aPins git:20261031.cac9d1a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- shimo4228/claude-harness
- Path
skills/hook-stocktake/SKILL.md- Versions recorded
- 1
- Latest version
- git:20261031.cac9d1a, committed Oct 31, 2026
- Size
- 6,518 bytes
- Repository stars
- 4
- License
- MIT
Audit the harness hooks (hooks/*.sh, scripts/hooks/*) and their settings.json wiring, and give each a verdict (hook の棚卸し).
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# hook-stocktake — Hook Quality Audit Evaluate every hook of the harness and assign each a verdict: `Keep / Improve / Update / Merge / Dissolve / Retire`. A hook's cost is unlike a skill's or a rule's: it runs unattended on every matching event, it can block, and it reads repo-controlled data (paths, commit metadata, tool input). So the questions are wiring, evidence that it still earns its place, test coverage, and its share of the harness threat surface (rule `security.md`). ## Phase 1 — Inventory and wiring (deterministic) Build the inventory with throwaway `python3` / `jq` over the files, and state the counts up front: - **Targets**: `hooks/*.sh` and `scripts/hooks/*.py`. `hooks/_*-common.sh` are shared libraries: list which hooks source each one (`grep -l 'source.*_<name>' hooks/*.sh`) - **Wiring**: from `~/.claude/settings.json` `hooks`, one row per (event, matcher, command). Mark every target no command references (orphan) and every command that carries logic beyond invoking a script (CLAUDE.md: hook logic lives in scripts). Commands whose script is missing (dangling) come from `python3 ~/.claude/scripts/hooks/harness_lint.py`, which checks them. …
Read the whole file at its exact version.
How to install
mdr add shimo4228/claude-harness/hook-stocktake@sha256:508e2b5a057c7f4eThe line at the top of this page pins the label git:20261031.cac9d1a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_bs5mg2t2jcsfrf4g)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Oct 31, 2026.
Audit of the latest version
- fail: No script tag (matched: <script)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6518 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
shimo4228/claude-harness · 4 stars · license MIT · pushed 2026-10-31 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_bs5mg2t2jcsfrf4g GET https://markdownregistry.com/api/v1/resolve?ref=shimo4228/claude-harness/hook-stocktake GET https://markdownregistry.com/api/v1/blob/508e2b5a057c7f4ed41f4a5946540bb0d34f4f81acca4fafb7583c77dd21826e
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from shimo4228/claude-harness
Every file in shimo4228/claude-harness