ruvnet/ruflo237 installs

harness-mint

Q: How do I install this agent skill?

Run npx skills add https://github.com/ruvnet/ruflo --skill harness-mint.

Q: Is this agent skill safe to install?

Review the displayed partner audits, complete source, permissions, dependencies, and exact revision before installing.

Scaffold a custom AI agent harness via `metaharness new <name> --template <id> --host <id>`. Defaults to DRY-RUN (no writes) unless --confirm is passed. Refuses to write to the calling repo root or anywhere inside it. Honors ADR-150 architectural constraint + ruflo's "destructive-action confirmation" pattern.

How do I install this agent skill?

npx skills add https://github.com/ruvnet/ruflo --skill harness-mint

view source ↗

Is this agent skill safe to install?

Gen Agent Trust Hubpass
This skill provides a way to scaffold AI agent harnesses using a specialized tool. It incorporates multiple built-in safety controls, including a mandatory dry-run mode by default, path validation to prevent overwriting existing project files, and execution timeouts to ensure sandboxed operations.
Socketwarn
1 alert: gptSecurity
Snykwarn
Risk: MEDIUM · 1 issue

What does this agent skill do?

The one write-capable skill in the plugin. Every other skill is pure-read. This one calls metaharness new, which writes a new directory tree.

Safety (load-bearing)

Dry-run by default. Without --confirm, the script prints what it would do and exits 0 without touching disk.
Refuses project root. If --target resolves to the current working directory OR any path inside it, the script errors out with exit 2. Target must be an absolute path OUTSIDE the calling repo (default is a fresh /tmp/ruflo-mint-<ts>-<name>/ dir).
Refuses existing target. Won't overwrite — must scaffold into a non-existent dir.
Subprocess + 60s timeout. No library import, no in-process execution. The mint stays sandboxed from ruflo's runtime.

Algorithm

Implementation: scripts/mint.mjs.

Validate --name, --template. Default --host to claude-code.
Resolve --target (default: temp dir).
Run safety checks (no project-root writes; target must not exist).
Without --confirm: emit dry-run plan, exit 0.
With --confirm: shell npx metaharness new <name> --template <id> --host <id> --target <abs> --yes.

Templates

minimal, vertical:coding, vertical:devops, vertical:support, vertical:legal, vertical:research, vertical:trading, vertical:health, vertical:education, vertical:sales, vertical:business, vertical:crm, vertical:marketing, vertical:advertising, vertical:ai, vertical:agentics, vertical:ruview, vertical:gaming, vertical:repo-maintainer, vertical:exotic.

Hosts

claude-code, codex, pi-dev, hermes, openclaw, rvm, copilot, opencode, github-actions.

Example dry-run

$ node scripts/mint.mjs --name my-harness --template vertical:coding --host claude-code
# harness-mint (dry-run)

- action: metaharness new
- name: my-harness
- template: vertical:coding
- host: claude-code
- target: /tmp/ruflo-mint-1718560000-my-harness
- confirm: false
- willWrite: false

Re-run with `--confirm` to actually scaffold.

Why dry-run by default

Ruflo's behavioral rules say "executing actions with care" — destructive or repo-touching actions need confirmation. The dry-run output makes the WHAT visible before the WHEN. A human sees target, decides, then adds --confirm if happy.

How can the creator link this skill?

Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.

<a href="https://skillzs.dev/skills/ruvnet/ruflo/harness-mint">View harness-mint on skillZs</a>