anthropics/defending-code-reference-harness
Skills for threat modeling, scanning, triage, patching, plus an autonomous scanning harness you can /customize
ARCHETYPE
Pragmatist
A balanced, no-drama setup: some rules, some tools, nothing extreme.
Copy this rig
# review before running: this installs third-party code
$ npx degit anthropics/defending-code-reference-harness/.claude ./rig-defending-code-reference-harness # inspect, then merge into .claude/ MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.
$ npx degit anthropics/defending-code-reference-harness/.claude/skills/customize .claude/skills/customize $ npx degit anthropics/defending-code-reference-harness/.claude/skills/dnr-hunt .claude/skills/dnr-hunt $ npx degit anthropics/defending-code-reference-harness/.claude/skills/dnr-respond .claude/skills/dnr-respond $ npx degit anthropics/defending-code-reference-harness/.claude/skills/patch .claude/skills/patch $ npx degit anthropics/defending-code-reference-harness/.claude/skills/quickstart .claude/skills/quickstart $ npx degit anthropics/defending-code-reference-harness/.claude/skills/threat-model .claude/skills/threat-model $ npx degit anthropics/defending-code-reference-harness/.claude/skills/triage .claude/skills/triage $ npx degit anthropics/defending-code-reference-harness/.claude/skills/verify .claude/skills/verify $ npx degit anthropics/defending-code-reference-harness/.claude/skills/vuln-scan .claude/skills/vuln-scan
This rig commits no guardrails. Here is the community baseline instead — the deny/ask rules most often found across all 6,413 rigs:
{
"permissions": {
"deny": [
"Read(~/.ssh/**)",
"Read(**/.env)",
"Bash(rm -rf *)",
"Read(./.env)",
"Bash(rm -rf /)",
"Bash(git push --force:*)",
"Bash(sudo *)",
"Read(**/*.pem)",
"Bash(rm -rf /*)",
"Read(~/.aws/**)",
"Bash(rm -rf:*)",
"Read(.env)",
"Bash(git push --force*)",
"Read(**/*.key)",
"Read(./.env.*)",
"Read(**/.env.*)",
"Bash(sudo:*)",
"Bash(git reset --hard*)",
"Bash(git reset --hard:*)",
"Read(.env.*)"
],
"ask": [
"Bash(git push:*)",
"Bash(git push *)",
"Bash(git commit:*)",
"Bash(rm *)",
"Bash(rm:*)",
"Bash(wget *)",
"Bash(npm publish:*)",
"Bash(gh pr merge *)",
"Bash(chown *)",
"Bash(docker *)"
]
}
} Skills (9)
Similar rigs
zenbu-labs/terminal-browser
A browser inside your terminal
Minimalist 815 tok ·
cosmtrek/mindwalk
A visualization tool that replays coding-agent sessions on a 3D map of your codebase.
Minimalist 1.1k tok ·
alleriasun/clearclaw
—
Minimalist 1.0k tok ·
robertiuoras/PaneForge
One window for every coding agent you own. Claude Code, Codex, Gemini CLI, Qwen, Ollama and more, each in its own terminal pane. Windows and macOS, free, no accounts, no server.
Minimalist 1.8k tok ·