by Prism-Shadow
🐧 Harness for RSI. Let AI Build AI
# Add to your Claude Code skills
git clone https://github.com/Prism-Shadow/penguin-harnessGuides for using ai agents skills like penguin-harness.
Last scanned: 7/22/2026
{
"issues": [
{
"file": "README.md",
"line": 101,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://penguin.ooo/install.sh | sh\"",
"severity": "low"
},
{
"file": "packages/skills/skills/firecrawl/SKILL.md",
"line": 24,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
},
{
"file": "packages/skills/skills/firecrawl/SKILL.md",
"line": 37,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
}
],
"status": "PASSED",
"scannedAt": "2026-07-22T06:27:41.276Z",
"npmAuditRan": false,
"pipAuditRan": true,
"promptInjectionRan": true
}penguin-harness is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by Prism-Shadow. 🐧 Harness for RSI. Let AI Build AI. It has 1,420 GitHub stars.
Yes. penguin-harness passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/Prism-Shadow/penguin-harness" and add it to your Claude Code skills directory (see the Installation section above).
penguin-harness is primarily written in TypeScript. It is open-source under Prism-Shadow on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh penguin-harness against similar tools.
No comments yet. Be the first to share your thoughts!
With LangChain, you build agents by hand — at 1× speed.With PenguinHarness, agents build agents — at 100×.
Three reasons, in deliberate order — from task quality, to how agents get built, to how they keep improving.
A deliberately minimal toolset over clean low-level interfaces: fewer tool calls, fewer tokens — deeply tuned for open models like DeepSeek. Each harness on the model it is normally paired with, same tasks, head-to-head:
Best accuracy on data analysis — at 1/70 of Claude Code's cost.
Type one sentence, and an agent builds the complete agent application for you — scaffold, code, and run instructions, end to end:
Collect the docs from https://github.com/ericbuess/claude-code-docs and build a RAG app that answers Claude Code questions as a configuration expert, citing its sources.
And this is the finished product — a docs expert with retrieval, cited sources that link to the original files, and example questions built in:
https://github.com/user-attachments/assets/9b7033e8-f08a-4c3f-bd33-547896664e6e
And generating this entire RAG app burned just $0.02 (¥0.2) of tokens — on DeepSeek V4 Pro.
With PenguinHarness Skills, an agent evaluates and optimizes itself: run the benchmark, find the lost points, ship version N+1 — with a snapshot before every round, and every request observable in the Trace view.
https://github.com/user-attachments/assets/922d13a6-5ffc-4685-9a39-352f02f9afc0
Four Skill groups ship in the box (docs); agents can also write and optimize their own:
| Group | Skills |
|---|---|
| Office Productivity | data-analysis, firecrawl |
| Software Development | web-design, software-engineering |
| AI App Development | penguin-sdk, penguin-cli, agenthub-models, vllm, ollama, llamafactory |
| Agent Tuning | agent-creation, benchmark-design, agent-evaluation, agent-optimization |
| Model | Providers |
|---|---|
| DeepSeek V4 | DeepSeek, OpenRouter, Fireworks AI, SiliconFlow, Qwen Token Plan, Qwen Pay-As-You-Go |
| Kimi K3 | Moonshot AI, OpenRouter, Qwen Pay-As-You-Go |
| GLM 5.2 | Z.AI, OpenRouter, Fireworks AI, SiliconFlow, Qwen Token Plan, Qwen Pay-As-You-Go |
| Hunyuan 3 | OpenRouter |
| Qwen 3.8 Max | Qwen Token Plan, Qwen Pay-As-You-Go, OpenRouter |
| GPT 5.6 | OpenRouter |
| Gemini 3.6 Flash | Google Gemini, OpenRouter |
| Claude 5 | Anthropic, OpenRouter |
| Inkling | OpenRouter, Fireworks AI |
Each family's latest generation only — the app's Models page lists every built-in preset, and any OpenAI-protocol endpoint works too: pick a preset, or point a custom endpoint at any of the 1000+ online and local models.
| Requirement | Supported |
|---|---|
| OS | Linux, macOS, Windows 10+ |
| Architecture | x64, arm64 |
| Runtime | bundled by the one-line installer (npm installs need Node >= 24) |
| Model | an API key for at least one model |
Two ways in — both work on the same ~/.penguin/data root, so a desktop install and a CLI install can be mixed freely:
penguin command on the machine; penguin web then serves the full Web experience in your browser at http://127.0.0.1:7364 (multi-session chat, agent / skill / model management, usage stats, Trace observability, evaluation center). The online installers bundle their own Node runtime — unpack and run; upgrades and reinstalls never touch your data.[!NOTE] On a CLI install, the first Web login is
admin, with the initial password (of the formpenguin-1234) printed as a framed notice on every server start until it is changed — change it right after. Models are configured on the in-app Models page.
The full Web experience as a standalone application: it embeds the server and opens already signed in — no terminal, no login page, no initial password to copy. It works on the same ~/.penguin/data root as a CLI install, so the two can be used interchangeably (a data root only ever runs one server; if a CLI-started instance is already up, the app attaches to it).
⬇️ Get it from the download page — the page serves the OSS-accelerated mirror when it is reachable, and every installer is also attached to each GitHub Release.
| Platform | Installers |
|---|---|
| macOS 11+ | dmg (Apple Silicon / Intel) |
| Windows 10+ | installer (.exe, x64) |
| Linux (x64) | AppImage / deb |
Current builds are unsigned, so the system may block the very first launch. Expand your platform for the one-time fix:
macOS quarantines files downloaded from the internet, and the missing signature makes that flag surface as a false “damaged” alert. Deleting the flag clears it:
PenguinHarness.app into the Applications folder.