Mjs Agent Skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mjs Agent Skills (MCP Server) and scored it 65/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 10 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 10 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Personal skill library that compounds value over decades. Skills are not tools. They are frozen decisions. Each skill encodes judgment about what matters, what fails, and what works.
A curated collection of Agent Skills — reusable units of intelligence that teach AI coding agents how to perform specific tasks autonomously.
Each skill encodes:
Traditional: You write code → Code runs → Application works
Agentic: You write Skills → AI learns patterns → AI writes code → Application worksThe bar is higher than MIT, OpenAI, or Google — because this optimizes for personal throughput, context dominance, and problem-to-solution compression, not coordination, publication, or scale.
If two skills plausibly trigger on the same query, at least one is incorrectly designed.
mjs-skills/
├── .claude/
│ ├── skills/ # The actual skills (22 total)
│ │ ├── meta/ # Skills about skills
│ │ ├── mcp-powered/ # MCP server wrappers
│ │ ├── infrastructure/ # K8s & cloud
│ │ ├── application/ # Service scaffolding
│ │ ├── ui-patterns/ # Chat & frontend
│ │ ├── integration/ # Connecting services
│ │ ├── devops/ # Deployment & docs
│ │ └── voice/ # Voice interfaces
│ │
│ ├── hooks/ # Evaluation & tracking
│ │ ├── track-prompt.sh # Log user prompts
│ │ ├── track-skill-start.sh # Detect skill activation
│ │ ├── track-skill-end.sh # Capture verify.py results
│ │ └── analyze-skills.py # Weekly usage analysis
│ │
│ └── activity-logs/ # Passive data collection
│ ├── prompts.jsonl
│ └── skill-usage.jsonl
│
├── research/ # Design documents
│ ├── skill-design-reference.md # How to build skills
│ ├── h3-skills-master-prd.md # What skills to build
│ └── skills-evaluation-prd.md # How to measure value
│
├── spec/ # Agent Skills Specification
│ └── ... # (cloned from agentskills.io)
│
├── CONSTITUTION.md # Governance principles
└── README.md # You are hereskill-name/
├── SKILL.md # YAML frontmatter + instructions (~300 tokens)
├── scripts/
│ ├── verify.py # Returns 0 (success) or 1 (failure)
│ └── deploy.sh # Optional: execution script
├── references/ # Optional: deep docs (loaded on-demand)
└── templates/ # Optional: reusable scaffolds---
name: deploying-kafka-k8s
description: |
Deploys Apache Kafka on Kubernetes using Helm.
Use when setting up event streaming or pub/sub messaging.
---
## Quick Start
[Immediate action - the 80% case]
## Instructions
1. [Step with command]
2. [Validation step]
## If Verification Fails
[Diagnostic commands + escalation]Claude Code hooks automatically track skill usage without manual intervention.
When Claude activates a skill, it reads the SKILL.md:
cat /path/to/.claude/skills/deploying-kafka-k8s/SKILL.mdPreToolUse hook detects this pattern → logs to skill-usage.jsonl
User prompt
→ UserPromptSubmit hook logs prompt
→ Claude reads SKILL.md (via cat/view)
→ PreToolUse hook detects skill activation
→ Skill executes
→ verify.py runs
→ PostToolUse hook captures success/failure
→ skill-usage.jsonl contains full trace| Metric | Source |
|---|---|
| Prompt-to-skill correlation | Session ID tracking |
| Skill invocation counts | PreToolUse events |
| Success/failure rates | verify.py exit codes |
| Unused skill detection | Weekly analysis |
git clone https://github.com/mshaukat/mjs-skills.git
cd mjs-skillschmod +x .claude/hooks/*.sh
# Add hook config to ~/.claude/settings.json (see research/skills-evaluation-prd.md)In Claude Code:
Deploy Kafka on my local Kubernetes clusterClaude will:
deploying-kafka-k8s skillverify.py to confirm successpython .claude/hooks/analyze-skills.pyBefore shipping any skill, test routing:
| Test | Query | Expected |
|---|---|---|
| Positive | "I need event streaming" | deploying-kafka-k8s fires |
| Negative | "Set up REST APIs" | deploying-kafka-k8s does NOT fire |
| Collision | "messaging for microservices" | Only ONE skill fires |
Would you recreate this skill if it were deleted?
If no → delete it.
| Document | Purpose |
|---|---|
| skill-design-reference.md | How to build skills |
| h3-skills-master-prd.md | What skills to build (22 skills with PRDs) |
| skills-evaluation-prd.md | How to measure skill value |
Skills work across:
Skills are frozen decisions. The goal is not to do less work, but to do the right work faster—and know why it works.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.