Harness Kit

Harness kit accompanies my latest blog post about how harnesses are structured and this is a take on building my own as a template to help show you how to build your own. It’s very much intended for showing and understanding the architecture, adapting the stage structure to a custom setup, or building something from scratch with a concrete model to follow.

Don’t mistake this for a fully functioning project however as this is not a functional harness and it won’t run out of the box, it’s been written in a manner to help you better understand things.

That said however, if you want something that works today, RAPTOR is where I’d recommend you start; this kit documents the structural thinking behind a pipeline like that rather than being a replacement for it.

What’s in here

The pipeline runs across five stages, each with its own system prompt template:

recon > hunt > validate > trace >  report

• Recon maps the target (subsystems, entry points, trust boundaries, git history) and produces a structured briefing that feeds into everything downstream.
• Hunt takes individual tasks from that queue and investigates specific vulnerability hypotheses concurrently, one agent per task.
• Validate acts as an adversarial reviewer, specifically tasked with finding reasons the finding is wrong rather than confirming it.
• Trace proves that attacker-controlled input actually reaches the vulnerable sink, with code references at every step.
• Report assembles everything that survived the trace gate into final output. Findings that fail validation or can’t be traced don’t make it through, which is the point.

Structure

skills/          Claude Code SKILL.md files; drop into .claude/skills/ or your skills directory
  _templates/    Expert and worker templates to build new stages from
  01-recon/
  02-hunt/
  03-validate/
  04-trace/
  05-report/
prompts/         Same stage prompts as standalone markdown, for use with any harness framework
config/
  model-routing.yaml    Which model runs at which stage and why
  context-budgets.yaml  Token limits and trim strategy per stage

What to customise

Each stage has clearly marked sections for what you should change, essentially at a minimum, recon needs your target’s tech stack so the agent knows what patterns to look for, whereas hunt needs the vulnerability classes adjusted to match your scope of research, validate’s rejection threshold should be tuned based on how much noise you’re willing to accept, trace needs a definition of what counts as attacker-controlled input for your threat model; and report needs your preferred output format (markdown, SARIF, JSON, or custom).

The model routing and context budget configs both have inline notes explaining the reasoning behind each decision, so adjusting them for your rate limits and cost targets should be straightforward.

Quick start

Claude Code: copy the skills directory into your project and invoke each stage directly, if you’re lazy you can probably get claude to build the skills for you from the template too to speed things up.

cp -r skills/ /path/to/your/project/.claude/skills/

Edit each SKILL.md, fill in the target-specific sections, then invoke with /01-recon, /02-hunt and so on.

Other frameworks: use the files in prompts/ as system prompts per stage. The config/ files document the model and context decisions so you can apply the same approach to whatever orchestration layer you’re using.