# Quickstart

The front door for this repo.

- Repository: https://github.com/anthropics/defending-code-reference-harness (7690 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-08-06
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add anthropics/defending-code-reference-harness --skill quickstart -g -a claude-code -y`
Codex: `npx skills add anthropics/defending-code-reference-harness --skill quickstart -g -a codex -y`
Cursor: `npx skills add anthropics/defending-code-reference-harness --skill quickstart -g -a cursor -y`
Gemini CLI: `npx skills add anthropics/defending-code-reference-harness --skill quickstart -g -a gemini-cli -y`

## Description

The front door for this repo. With no argument: a 30-second intro, then an offer to walk you through your first run on the canary target. With a question: answers it from this repo's own docs and source, cites where it looked, and hands you the next command. Use for "how do I…", "why does…", "where is…", "can this…", or just "/quickstart" to get oriented.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# /quickstart

Two modes, picked by whether `$ARGUMENTS` is empty.

- **Empty → Intro mode.** Short orientation, then offer the guided first run.
- **Non-empty → Help mode.** Treat `$ARGUMENTS` as the operator's question.

---

## Intro mode

Keep it short and a little warm; this is the first thing a new operator sees.

Say roughly:

> **Welcome!** This repo takes you from finding your first vulnerability to
> patching at scale, using a set of Claude Code skills and an autonomous
> pipeline. Two ways in: **interactive skills** (no setup, safe, start here)
> and the **autonomous pipeline** (Docker, scales to hundreds of parallel
> agents).
>
> The ramp-up:
>
> | Day 1   | Threat-model + first static scan + triage |
> | Day 2   | Run the reference pipeline (C/C++)              |
> | Day 3-4 | Customize it for your stack               |
> | Week 2  | Autonomous scanning, triage, and patching |
>
> Day-1 goal: threat-model, scan, and triage the bundled canary target.
> Most teams get there before lunch.

Remind them to `export CLAUDE_CODE_SUBAGENT_MODEL=<model-id>` so subagents
use the same model as the session.

Then **AskUserQuestion** with three options:

1. **Walk me through Day 1 on the canary (~10 min)** → run "Guided first
   run" below.
2. **I have a question** → ask what it is, then switch to Help mode.
3. **I'll read the README** → point at `README.md` Step 1 and stop.

### Guided first run

Runs the three Step-1 skills on `targets/canary`, pausing after each to show
what landed on disk. These only read/write files in the repo; no sandbox
needed.

The rest: https://github.com/anthropics/defending-code-reference-harness/blob/HEAD/.claude/skills/quickstart/SKILL.md