Skip to content
Back to skills

Harmoniis Harmonia .

DSecurity

Binary: `harmonia` | Install: `curl --proto '=https' --tlsv1.2 -sSf https://harmoniis.com/harmonia/install | sh` | Windows: `iwr https://harmoniis.com/harmonia/install.ps1 -UseB | iex` Distributed evolutionary homoiconic self-improving agent. SBCL Common Lisp core + modular Rust tool ecosystem via CFFI.

  • 4 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 12, 2026
developmentrustgoshellbashsqlexpressawsgitapidatabase

Works with

  • cli
  • api

Security analysis

D46/100
  • criticalPipes output to a shell interpreter
  • mediumUses curl or wget to download content
  • criticalDownloads and executes remote scripts — classic supply chain attack

Pro scans all 2 files and shows the line behind each finding

Scanned September 12, 2026

npx -y skills add aibot88/sec_skill_store --skill harmoniis-harmonia-. --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Harmoniis Harmonia .?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Harmoniis Harmonia .
[![Security: D — Skills Directory](https://www.skillsdirectory.com/api/skills/aibot88-harmoniis-harmonia/badge)](https://www.skillsdirectory.com/skills/aibot88-harmoniis-harmonia)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
# Harmonia Agent — Agent Skill

Binary: `harmonia` | Install: `curl --proto '=https' --tlsv1.2 -sSf https://harmoniis.com/harmonia/install | sh` | Windows: `iwr https://harmoniis.com/harmonia/install.ps1 -UseB | iex`

Distributed evolutionary homoiconic self-improving agent. SBCL Common Lisp core + modular Rust tool ecosystem via CFFI.

## Install

macOS / Linux / FreeBSD:
```bash
curl --proto '=https' --tlsv1.2 -sSf https://harmoniis.com/harmonia/install | sh
```

Windows (PowerShell):
```powershell
iwr https://harmoniis.com/harmonia/install.ps1 -UseB | iex
```

Binary-first install with source-build fallback. Optional overrides:
```bash
HARMONIA_INSTALL_MODE=source curl -sSf https://harmoniis.com/harmonia/install | sh   # force source build
HARMONIA_WITH_SOURCE=1 curl -sSf https://harmoniis.com/harmonia/install | sh          # binary + local source for self-rewrite
```

### Prerequisites

| Dependency | Why | Install |
|---|---|---|
| Rust 1.89+ | Builds tool crates | rustup.rs |
| SBCL | Agent runtime | `brew install sbcl` / `apt install sbcl` |
| Quicklisp | Lisp packages | Auto-installed by `harmonia setup` |

## Setup

```bash
harmonia setup    # interactive wizard
harmonia start    # start agent
harmonia upgrade  # update to latest release
harmonia uninstall
```

### Setup Wizard Steps

1. Creates system workspace at `~/.harmoniis/harmonia/`
2. Asks for user workspace directory (default: `~/workspace`)
3. Verifies SBCL + Quicklisp
4. Bootstraps vault keys from `harmoniis-wallet`
5. Select LLM providers and store API keys in encrypted vault (OpenRouter recommended)
6. Choose evolution profile: `binary-only` | `source-rewrite` | `distributed participant`
7. Git fork URL + optional GitHub PAT (stored in vault)
8. Optional S3 credentials for binary backups (stored in vault)
9. Select frontends to enable + collect frontend credentials (stored in vault)
10. Build and configure everything

**No model selection required.** The backend owns a built-in model pool with pricing. Model selection is automatic via harmonic scoring and evolves over time.

## Configuration

Workspace: `~/.harmoniis/harmonia/` (user data only)

```
~/.harmoniis/harmonia/
├── vault.db          # encrypted secrets (SQLite, AES-256-GCM)
├── config.db         # non-secret configuration (SQLite, config-store v2)
├── metrics.db        # model performance metrics (SQLite, auto-created)
├── config/
│   ├── workspace.sexp
│   └── gateway-frontends.sexp
├── genesis/          # evolution knowledge
├── state/            # runtime state, sockets, caches
└── frontends/        # frontend state and attachments
```

Installed application assets:
- macOS / Linux / FreeBSD: `~/.local/bin/harmonia`, `~/.local/lib/harmonia/`, `~/.local/share/harmonia/`
- Windows: `%LOCALAPPDATA%\Harmonia\bin\`, `%LOCALAPPDATA%\Harmonia\lib\`, `%LOCALAPPDATA%\Harmonia\share\`

Key config files (S-expressions):
- `harmony-policy.sexp` — security, evolution, harmonic routing
- `model-policy.sexp` — harmonic scoring weights for model evolution
- `baseband.sexp` — frontend registry + mesh transport
- `tools.sexp` — tool availability
- `swarm.sexp` — parallel agent orchestration

### Secrets

**Vault** (`vault.db`) — secrets only (API keys, tokens, passwords). AES-256-GCM encryption, component-scoped access policies. Each module reads only its own secrets.

**Config-store** (`config.db`) — all non-secret configuration (URLs, timeouts, paths, modes, feature flags). SQLite-backed with in-memory cache. Component-scoped read/write policies mirror vault's model. Fallback chain: cache → DB → legacy env alias → canonical `HARMONIA_{SCOPE}_{KEY}` → default.

No raw environment variables at runtime except bootstrap paths (`HARMONIA_STATE_ROOT`, `HARMONIA_LIB_DIR`). Setup writes everything directly to vault and config-store.

## Architecture

```
SBCL Common Lisp (Conductor + Memory + Self-Rewrite/Ouroboros)
         │ CFFI
Rust .so Libraries (Core + Tools + Backend + Frontends)
```

### Core Crates
phoenix (hot-reload/recovery), ouroboros (self-rewrite), vault (encrypted secrets), memory (persistent + compression), http, s3, git-ops, rust-forge (runtime compilation), cron-scheduler, push (webhooks), recovery, fs, parallel-agents, harmonic-matrix, config-store, tailnet, gateway.

### Backend — Model Pool Protocol
Each LLM provider is a separate backend crate implementing the standardised provider protocol (`harmonia-provider-protocol`):

| Backend | Crate | API Style |
|---|---|---|
| OpenRouter | `harmonia-openrouter` | OpenAI-compatible gateway (routes all) |
| OpenAI | `harmonia-openai` | OpenAI native |
| Anthropic | `harmonia-anthropic` | Anthropic Messages API |
| xAI (Grok) | `harmonia-xai` | OpenAI-compatible + reasoning |
| Google AI Studio | `harmonia-google-ai-studio` | Google Generative AI REST |
| Google Vertex AI | `harmonia-google-vertex` | Vertex AI REST + Bearer token |
| Amazon Bedrock | `harmonia-amazon-bedrock` | AWS CLI bedrock-runtime converse |
| Groq | `harmonia-groq` | OpenAI-compatible |
| Alibaba (Qwen) | `harmonia-alibaba` | OpenAI-compatible (DashScope) |

The backend exposes a standardised **model offerings protocol** via FFI:

| FFI Function | Returns | Purpose |
|---|---|---|
| `harmonia_openrouter_list_models()` | JSON array | All available models with pricing, quality, speed, tags |
| `harmonia_openrouter_select_model(task_hint)` | Model ID | Best model for task category via pool scoring |
| `harmonia_openrouter_complete(prompt, model)` | Text | Complete with explicit model (or empty for auto-select) |
| `harmonia_openrouter_complete_for_task(prompt, task_hint)` | Text | Complete with task-aware model selection |

**Initial model pool** (bootstrap tier — cheapest/fastest):

| Model | Tier | USD/1K in | USD/1K out | Tags |
|---|---|---|---|---|
| google/gemini-3.1-flash-lite-preview | micro | 0.00025 | 0.0015 | fast, memory-ops, casual |
| deepseek/deepseek-chat-v3.1:free | free | 0.0 | 0.0 | reasoning, casual |
| qwen/qwen3-coder:free | free | 0.0 | 0.0 | coding, execution |
| qwen/qwen3.5-flash-02-23 | lite | 0.0 | 0.0 | fast, coding, execution, reasoning |
| minimax/minimax-m2.5 | lite | 0.0003 | 0.0012 | balanced, memory-ops, casual |
| amazon/nova-micro-v1 | micro | 0.000035 | 0.00014 | fast, routing |

Higher tiers (orchestration, software-dev) available via `harmonia_openrouter_select_model("orchestration")`.

Task hints: `orchestration`, `execution`, `memory-ops`, `coding`, `reasoning`, `casual`, `software-dev`.

Performance is measured per-request (latency, success) and written to the SQLite `metrics.db` database (resolved via config-store `global/state-root`). Four tables:
- `models` — full model catalogue (290+ models synced from OpenRouter API + hardcoded), with per-token pricing, context length, modality
- `llm_perf` — every LLM backend call (backend, model, latency_ms, success, pricing)
- `parallel_tasks` — parallel-agent task completions (cost, verification)
- `tmux_events` — tmux CLI agent lifecycle events (spawn, input, approve, deny, kill) with `cost_usd` and `duration_ms` tracking

On init, the OpenRouter backend syncs the full model catalogue from `https://openrouter.ai/api/v1/models` (background thread). All hardcoded backend offerings are also registered. The `models` table is the agent's single source of truth for what models exist and what they cost.

### Metrics Query FFI

The orchestrator queries the metrics database via FFI. The agent can run **arbitrary SELECT SQL** for maximum flexibility:

| FFI Function | Returns | Purpose |
|---|---|---|
| `harmonia_metrics_query_json(sql)` | JSON array | Run any SELECT query, get results as JSON |
| `harmonia_metrics_query_sexp(sql)` | S-expression | Run any SELECT query, get results as s-expression plists |
| `harmonia_metrics_sync_models(api_key)` | Count or -1 | Sync model catalogue from OpenRouter API |
| `harmonia_metrics_model_stats(model)` | S-expression | Per-model stats: count, success-rate, avg-latency, pricing |
| `harmonia_metrics_best_models(backend, limit)` | S-expression list | Top-performing models ranked by success rate + speed |
| `harmonia_metrics_llm_report()` | S-expression | Full LLM backend performance report |
| `harmonia_metrics_tmux_report()` | S-expression | Tmux agent event summary |
| `harmonia_metrics_telemetry_digest()` | S-expression | Combined digest for harmonic orchestration decisions |
| `harmonia_metrics_bridge_routes(since_ts)` | S-expression | Recent LLM perf as route entries for harmonic matrix |

Example SQL queries the agent can run:
```sql
-- Cheapest models with >8K context
SELECT id, name, usd_per_tok_in, usd_per_tok_out, context_length
FROM models WHERE context_length > 8000 ORDER BY usd_per_tok_in ASC LIMIT 20

-- Best performing models in last hour
SELECT model, COUNT(*) n, AVG(CAST(success AS REAL)) sr, AVG(latency_ms) lat
FROM llm_perf WHERE ts > unixepoch()-3600 GROUP BY model ORDER BY sr DESC, lat ASC

-- Cost analysis by provider
SELECT provider, COUNT(*) models, MIN(usd_per_tok_in) cheapest_in, MIN(usd_per_tok_out) cheapest_out
FROM models WHERE usd_per_tok_in > 0 GROUP BY provider ORDER BY cheapest_in ASC
```

### Tools
browser (Chrome CDP with stealth anti-detection), search-exa (neural), search-brave, hfetch (secure HTTP), zoom (meeting automation).

### Voice Backends
voice-router dispatches to: whisper (STT via Groq/OpenAI), elevenlabs (TTS).

### Frontends (hot-pluggable via dlopen)
TUI (always on), MQTT, Telegram, Slack, Discord, Signal (signal-cli bridge), WhatsApp, iMessage (BlueBubbles), Mattermost, Nostr, Email (IMAP/SMTP), Tailscale mesh.

## Security

Two-layer model:
1. **Security Kernel** (deterministic, non-bypassable) — typed signal dispatch, policy gate for privileged ops, taint propagation, safe parsers.
2. **Adaptive Security Shell** — dissonance scoring (18 injection patterns), harmonic routing, component-scoped vault policies.

Policy gate blocks privileged ops if signal has external taint or lacks `:owner`/`:authenticated` label.

## Evolution Profiles

- `binary-only` — use released binaries, no self-modification
- `source-rewrite` — agent can edit and recompile its own source
- `distributed participant` — participate in cross-instance evolution

## LLM Model Routing

14 model profiles from micro (nova-micro) to frontier (claude-opus-4.6, gpt-5). No "default model" — model selection is **task-aware and score-based**:
- Different models for orchestration, coding, memory-ops, casual
- Round-robin through pool initially to gather performance data
- Harmonic-matrix evolves selection based on measured latency, success rate, and cost
- Scoring weights: completion 30%, correctness 20%, speed 12%, price 12%, token-efficiency 10%, orchestration-efficiency 10%, experience 6%

## Platforms

macOS (Apple Silicon / Intel), Linux (x86_64 / aarch64), FreeBSD, Windows.

## License

Harmonia Community License 1.0 (HCL-1.0). Free for all use — individuals, freelancers, companies. Only restriction: hosting Harmonia as a managed service for third parties requires a commercial license. Contact license@harmoniis.com.

## Build from Source

```bash
git clone https://github.com/harmoniis/harmonia.git && cd harmonia
bazel build //...   # or: cargo build --release
bazel test //...    # or: cargo test --workspace
```

Source: https://github.com/harmoniis/harmonia
Docs: https://harmoniis.com/docs/harmonia/overview
Marketplace: https://harmoniis.com/skill.md

Files in this skill

  • SKILL.md11.3 KB
  • source.json772 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…