enrich-capability — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited enrich-capability (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The latent half of the three-layer ingest pipeline. Where /ingest-source orchestrates the workflow and auxiliar ingest handles the deterministic transforms, this skill does the judgment: reading an upstream README, holding contradictions in mind, and synthesizing what an agent in-loop would search for to find this capability.
This is the "diarization" step from memos/Arquitetura.pdf — the model reads everything about a subject and writes a structured profile. No keyword extractor produces this. No embedding similarity finds the right choose_if line. The model has to actually read the README and make a judgment.
| Parameter | Required | Example | Meaning |
|---|---|---|---|
RECORD | yes | data/capabilities-staging/mcp-registry/ac-tandem-docs-mcp.yml | Path to the thin staging YAML |
MAX_FETCH_KB | no | 200 | Cap on upstream README fetch size (default 200 KB) |
/ingest-source (the canonical caller).README changed substantially.
These are the fields agents need to find and pick the capability — the ones the upstream registry can never supply.
| Field | What it captures | How to think about it |
|---|---|---|
jtbd_tags | The jobs-to-be-done an agent searching for anything should hit this record for | 5–12 short kebab-case tags. Think: "if an agent emits a query like 'X', should this rank? Then X is a jtbd_tag." |
aliases_search | Sentence-form queries agents emit in the wild | 8–15 entries. Mix short (3–5 word) lookups with multi-clause sentences (the 10–20 word queries the GPT-5 agent-journey simulation observed). Include PT-BR if the upstream serves a Portuguese audience. |
categories | Hugo-facing taxonomy | 2–4 entries. Pick from existing categories where possible (read other records in data/capabilities/*.yml to align). |
choose_if | One paragraph: when an agent should pick this over alternatives | Stay concrete — name the alternative class and the trade-off. "You need X and don't mind Y." |
avoid_if | One paragraph: when the agent should look elsewhere | Be honest about scope limits. The framework: "trust the reader." |
Optionally, if the README makes it unambiguous:
cost.type flip from unknown to free / freemium / usage_based.Only update if there's an explicit pricing statement in the README, not a guess.
risks[] append — material risks the README discloses (rate limits,scope limits, lock-in, etc.). Skip if not stated.
compliance[] append — explicit SOC2 / HIPAA / LGPD claims only.The 2026-05-14 graduation gate ran against 135 wave-1 enriched records and FAILed 11 on hallucinations the enrichment confidently asserted without README support. The pattern was systemic — 7 of 87 PP records claimed license: MIT despite the README mentioning no license at all. The same shape applies to runtime versions and risk specifics.
These fields can only be written when the upstream source literally contains the claim. If you don't see it verbatim or near-verbatim in the README / package.json / pyproject.toml / equivalent, leave the field unset (or as null):
| Field | Required source signal |
|---|---|
license | A literal "LICENSE", "License: MIT", "Apache-2.0", "MIT-licensed", "License: …" string in the README, OR a license field in package.json / pyproject.toml / Cargo.toml. If the README is silent and there's no manifest field, set license: null. Don't infer from sibling records in the same monorepo unless the README says "this project is MIT-licensed, like its siblings". |
deps.minimum_runtime | An explicit version string in the README's Install or Requirements section (e.g., "Requires Node.js ≥ 18", "Go 1.22 or newer"). Never invent a specific point release the README doesn't state. Never assert a version that doesn't exist (check that "Go 1.X.Y" is a real released version — Go is currently in the 1.2x range, not 1.26+). |
risks[] with rate-limit numerics | The README must state the actual cap ("60 req/min", "1000/day free tier"). Don't infer from "tight rate limits" prose. If the README says "rate-limited" without numbers, append the risk with severity: medium, category: rate_limit, description: README states rate-limited; specific limits not disclosed. |
risks[] citing specific exit codes / flags | The README must show the code or flag in an example or table. Don't infer exit code semantics from sibling records. |
risks[] with deprecation dates | The README must state the date explicitly ("EOL 2026-06-01", "deprecated since v3.0 released 2026-02-15"). Don't manufacture a future date. |
repository / external_homepage | The README, MCP Registry record, or upstream catalog must literally contain this URL. If the GitHub username in your candidate URL doesn't appear in the README's clone instructions or badges, you have the wrong repo. |
The graduation gate (src/auxiliar/curator/graduation.py) reads the README and asks Claude Sonnet 4.6 specifically about these fields. Records that fail go back to experimental status and need re-enrichment — expensive. Better to leave a field unset than to fail graduation later.
repository, cost, risks, compliance values not in thesource.
license, deps.minimum_runtime, or specific risks[]numerics / codes / dates without literal upstream evidence (see the table above). The graduation gate will catch and reject these.
experimental: false — that's the orchestrator's job aftercurator smoke passes.
data/capabilities/ directly. Always operate on the stagingYAML.
Read the staging YAML. Note:
provenance — tells you which source this came from.repository, external_homepage, mcp_registry_id — your entrypoints for the upstream fetch.
description — usually one line of upstream marketing copy; helpfulbut rarely sufficient.
Use the deterministic tool of choice (gh api, raw.githubusercontent.com, WebFetch). Cap at MAX_FETCH_KB. If the upstream has no README, also fetch any docs/ index and the first 100 lines of package.json / pyproject.toml / cargo.toml.
If after this you still can't tell what the capability does, return INSUFFICIENT_DATA and let the orchestrator mark the record for retry. Do not guess.
Hold the thin record + the README + any sample interactions in mind at once. Ask:
Concrete tasks, not abstract categories. Write 5–12 jtbd_tags.
phrases with full-sentence queries. Write 8–15 aliases_search. If the agent's user is likely Brazilian-Portuguese-speaking (BR data, PT documentation), include 2–5 PT-BR entries — the GPT-5 agent-journey simulation showed models auto-translate to PT-BR for Brazilian topics even when the input is English.
choose_if. Name an alternative class.
avoid_if. Name a scope limit the README states.
For the framework's "says vs actually building" gap-check: if the upstream description and the README disagree about scope (e.g., README shows much narrower coverage than the marketing line), call that out in risks[] with category scope.
Edit the staging YAML in-place. Preserve existing fields exactly. Append the new ones in this order: jtbd_tags, aliases_search, categories, choose_if, avoid_if. If you appended to risks[], keep severity correct: low for scope limits, medium for rate limits or lock-in, high only when the README admits production- unsafe gaps.
Round-trip the YAML through Capability.model_validate (Python REPL or python -m auxiliar.cli.ingest dedup --dry-run against a temp dir). If validation fails, revert and return the error to the orchestrator.
Return a short summary:
A pre-enrichment thin record (from MCP Registry):
id: ac-tandem-docs-mcp
element_type: mcp
name: ac.tandem/docs-mcp
description: Remote MCP server for Tandem docs, install guides, SDKs, workflows, and agent setup help.
cost:
type: unknown
last_verified: '2026-05-11'
verification_method: mcp-registry-ingest-2026-05-11
page_url: https://auxiliar.ai/mcp/ac-tandem-docs-mcp/
provenance: mcp-registry
experimental: true
mcp_registry_id: ac.tandem/docs-mcp
repository: https://github.com/frumu-ai/tandem
external_homepage: https://github.com/frumu-ai/tandemPost-enrichment (illustrative — not authoritative):
# ... all fields above kept verbatim ...
jtbd_tags:
- tandem-docs-lookup
- read-tandem-install-guides
- tandem-sdk-reference
- find-agent-setup-help
- mcp-host-config-docs
aliases_search:
- tandem docs
- how do I install tandem
- tandem MCP server agent setup
- I need to read the tandem SDK reference inside my agent
- tandem workflow documentation accessible from claude desktop
categories:
- documentation
- agent-tooling
choose_if: >-
You're inside a Claude Desktop or Cursor session and need to look up
Tandem-specific install guides, SDK reference, or agent-setup workflows
without leaving the session. Streamable-HTTP transport keeps roundtrip
fast inside the host.
avoid_if: >-
You need Tandem's product features themselves (the docs MCP is read-only
reference). Also avoid if the agent already has the Tandem docs cached —
no marginal benefit and adds one MCP to the registration surface.data/capabilities/<slug>.yml (that's `auxiliaringest promote` after the orchestrator approves).
repository / homepage / docs index. Discovery isn't the job here.
docs/proposals/three-layer-ingest.md — the architecturememos/Arquitetura.pdf — diarization (step 5 in the framework)docs/proposals/capability-schema.md — what fields exist + invariantsdata/capabilities/*.yml — read 5–10 well-enriched hand-curatedrecords before writing your first enrichment, to align style and depth
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.