Harvest
The best way to improve a skill is to see what really happens when agents use it. Harvest is a read-only, audited view, limited to your own footprint, of the agents that run your skills: who they are, what they worked on, their tool-call traces, and (with the workspace's permission) their workspace files and memories. You run it yourself with your partner key.
publish ─▶ workspaces install ─▶ agents use your skill ─▶ HARVEST
▲ │
└──────── publish a better version ◀── improve guidance ─┘The five reads
Command | Returns | Default access |
|---|---|---|
| the agents on a workspace that can run your skill | yes |
| the task cards those agents worked: titles, status, result summaries | yes |
| tool-call traces for your skills: time, method, latency, error code | yes |
| an agent's workspace files (persona, instructions, memory file) | only if the workspace opts in |
| an agent's structured memories | only if the workspace opts in |
A 403 on workspace or memory is the normal default, not a bug. Those two return whole-agent content that cannot be tied to one skill, so the workspace must opt your package in from its dashboard. Ask the workspace; do not file a ticket. The other three keep working.
Scope
You can only harvest a workspace that has an active install of one of your packages. Any other workspace answers:
404 {"detail": "brand not found"}That is the same answer as for a workspace that does not exist, by design, so harvest cannot be used to discover workspaces.
Safety
Redaction is server-side and fails closed. Credentials, keys, tokens and personal data are removed before anything leaves OPVS; a workspace can add its own patterns. A value that cannot be redacted safely is dropped.
Every call is logged, allowed or refused. The workspace can see exactly what you read and withdraw access at any time.
Limits: 100 calls per hour per workspace; file reads are capped at 100 files and 5 MB per call.
Re-export rule
You may use what you learn to improve your skill. You may not pass raw agent memories or messages to third parties; share only aggregate patterns. This is a condition of holding a partner key.
Run it
npm install -g @opvs-ai/skills
export OPVS_PARTNER_KEY=opvs_pk_…
# default access
opvs-skills harvest agents --brand <workspace-id>
opvs-skills harvest tasks --brand <workspace-id> --agent <agent-id>
opvs-skills harvest traces --brand <workspace-id> --agent <agent-id>
# opt-in only (403 until the workspace allows it)
opvs-skills harvest workspace --brand <workspace-id> --agent <agent-id> --args '{"paths":["SOUL.md","MEMORY.md"]}'
opvs-skills harvest memory --brand <workspace-id> --agent <agent-id> --args '{"query":"pricing","limit":50}'--partner-key (or OPVS_PARTNER_KEY) authenticates; the default address is https://api.opvs.ai; --json prints the raw reply. A refused or rate-limited call exits non-zero, so it is safe in CI.