janitor-value — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited janitor-value (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Show whether each installed skill is earning the context-window tokens it costs.
Combine token cost and usage tracking into a single view of every installed skill, sorted with the heaviest unused skills at the top. The report splits each skill's cost into what is permanently loaded (the description) and what only loads on demand (the body), then cross-references recent invocations so the user can see which skills are dead weight.
Replaces the v1.2 split between /janitor-tokens (cost only) and /janitor-usage (usage only).
scripts/value.sh)~/.claude/skills, ~/.claude/agents, and local Claude Code session historybash ~/.claude/skills/skills-janitor/scripts/value.sh [--weeks N] [--budget N] [--json]--weeks N — usage lookback window (default: 4)--budget N — context window size for % calculations (default: 200000)--json — emit raw JSONShow the table and summary to the user. When explaining results, do NOT describe body tokens as permanent context cost — only descriptions are always loaded. Plugin-namespaced skills appear with their full invocation name (e.g., marketing-skills:image, figma:figma-use).
If "unused skill cost" exceeds 20% of the budget, recommend the user run /janitor-report for a full health check or (in v1.4+) /janitor-swipe to triage interactively.
A table of every installed skill with:
yes if invoked in the lookback window, else NOFollowed by a summary:
~/.claude/agents, reported as % of budget)value.sh: No such file or directorySolution: The plugin is installed under a different root. Locate it with ls ~/.claude/skills or check the plugin cache, then run the script from its actual location.
NO in the Used? columnSolution: The lookback window may be too short or session history is empty. Re-run with a longer window, e.g. --weeks 12.
Solution: Its SKILL.md is missing or unreadable. Run /janitor-report to surface broken skills, then /janitor-fix --prune to clean them up.
Solution: Pass the correct context size explicitly, e.g. --budget 500000.
Input: "Are my skills worth their token cost?"
Output: Run bash ~/.claude/skills/skills-janitor/scripts/value.sh, then present the table sorted by waste and the summary line, e.g. "Always-loaded total: 8,420 tokens (4.2% of 200k budget). 6 of 31 skills unused in 4 weeks; top waster: heavy-skill (1,900 tokens, never used)."
Input: "Check skill usage over the last quarter against a 500k window."
Output: Run bash ~/.claude/skills/skills-janitor/scripts/value.sh --weeks 12 --budget 500000 and present the same table with the adjusted lookback and percentages.
Input: "Give me the raw skill value data."
Output: Run the script with --json and return the JSON payload unmodified.
For the MCP side of context cost, run bash {baseDir}/../../scripts/mcp.sh [--weeks N] — inventories every configured server (user, project, plugin) with REAL call counts from session transcripts, and lists servers unused in the window. No token guesses: schemas live server-side, so the janitor reports calls, distinct tools used, and last-used instead.
{baseDir}/../../scripts/value.sh/janitor-report — full health check including duplicates and broken skills/janitor-fix --prune — remove broken symlinks and empty skill dirs/janitor-discover — find new skills or check one before installing~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.