CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

mcp-skill-hub

为 Agent 接入第三方能力时使用——决定走 MCP 协议还是 Skill Hub 分发、搭建或选用 MCP 服务器、设计工具/资源/提示三类原语、评估引入第三方能力的 token 成本与安全风险、审查工具描述投毒与同名工具遮蔽、锁定服务器版本与配置最小权限凭证时查阅。含 MCP 客户端-服务器架构、传输层选型与供应链缓解清单。

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, opinionated decision/reference skill whose core value — MCP vs Skill Hub trade-offs and a third-party capability security checklist — is concrete and actionable. Its weaknesses are background re-explanations Claude doesn't need, dated facts, and external references that don't resolve within the bundle.

Suggestions

Trim the background Claude already knows (what MCP is, client-server architecture, the three primitives' definitions, stdio vs HTTP basics) down to one-line reminders, keeping only the decision-relevant deltas; this would lift conciseness toward the lean end.

Fix or remove the dangling 配套代码/深度阅读 references: either ship `chapter4/` experiments and `book/chapter4.md` inside the skill's references/ directory with clearly signaled one-level-deep links, or drop the pointers and keep the distilled guidance self-contained.

Move dated, time-sensitive facts ("skills.sh(Vercel,2026-01)", "MCP 是 Anthropic 2024 年底发布") into a clearly marked ecosystem/version section or strip the dates so the skill doesn't age.

DimensionReasoningScore

Conciseness

The body is dense and well-structured, but it re-explains concepts Claude already knows — "MCP 是 Anthropic 2024 年底发布的开放标准,统一 AI 模型与外部工具、数据源的通信协议", the client-server architecture description, and the tools/resources/prompts primitive definitions. It also carries time-sensitive dates ("skills.sh(Vercel,2026-01)") not placed in a deprecated/old-patterns section. The genuinely novel material (token-cost asymmetry, description poisoning, tool shadowing, mitigation checklist) is efficient; the background material could be trimmed.

3 / 5

Actionability

For an instruction-only skill the guidance is concrete: a channel-selection table, a copy-paste command (`npx skills add <owner>/<repo>`), a decision rule of thumb tied to explicit criteria ("结构化参数、可测试、可版本化服务端逻辑"), and an itemized pre-integration security checklist with specific mitigations (pin versions, per-server least-privilege credentials, sidecar review, sandbox untrusted skills). Minor gaps: no example of what an audited tool description looks like or how to configure a pinned server.

4 / 5

Workflow Clarity

The 实践模式 section is sequenced (1. 渠道选择 → 2. 架构与原语 → 3. 传输层 → 4. 安全审查清单) and the security checklist is framed as an explicit pre-integration checkpoint ("接入前逐项过"), with 常见陷阱 as a failure-mode list. This is a decision/reference skill rather than a fragile multi-step operation, so no hard validation cap applies, but the checklist reads as a list of risks plus mitigations rather than an ordered gate sequence with error-recovery loops.

4 / 5

Progressive Disclosure

Internal structure is good (clear headers, tables, lists), but the only external navigation — 配套代码 pointing to `chapter4/perception-tools/`, `chapter4/execution-tools/`, `chapter4/collaboration-tools/` and 深度阅读 pointing to `book/chapter4.md` — references paths that do not exist in the skill bundle (no references/, scripts/, or assets/ directories are present). Scored against the actual bundle structure, these dangling references leave deeper material unreachable; content that belongs in resolvable reference files is either missing or inlined.

3 / 5

Total

14

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, complete description that states concrete capabilities, an explicit use-when trigger, and distinct MCP/Skill Hub trigger vocabulary in third person. Only minor gaps: a few natural synonyms and the expanded protocol name are missing.

DimensionReasoningScore

Specificity

The description enumerates multiple concrete actions: "决定走 MCP 协议还是 Skill Hub 分发、搭建或选用 MCP 服务器、设计工具/资源/提示三类原语、评估…token 成本与安全风险、审查工具描述投毒与同名工具遮蔽、锁定服务器版本与配置最小权限凭证", plus a coverage statement of the body ("含 MCP 客户端-服务器架构、传输层选型与供应链缓解清单"). This matches the comprehensive-coverage anchor; not the level below because coverage has no notable gaps.

5 / 5

Completeness

Both halves are explicit: an explicit trigger clause "为 Agent 接入第三方能力时使用…时查阅" (when), and a clear statement of what the skill contains and does — the enumerated actions plus "含 MCP 客户端-服务器架构、传输层选型与供应链缓解清单" (what). This matches the anchor where both what AND when are clearly and explicitly answered with concrete trigger phrases.

5 / 5

Trigger Term Quality

Strong natural terms users would actually say: "MCP 服务器", "Skill Hub", "第三方能力", "token 成本", "安全风险", "工具描述投毒", "同名工具遮蔽", "版本锁定". Missing a few common variations — the expanded English name "Model Context Protocol", and generic phrasings like "给 Agent 加插件/工具" — so it falls just short of the comprehensive-synonyms anchor.

4 / 5

Distinctiveness Conflict Risk

The MCP-vs-Skill-Hub selection and third-party capability security-review niche is distinct with its own trigger vocabulary, so it is unlikely to fire for the wrong skill. Minor overlap remains with a generic agent/tool-security skill or a pure "build an MCP server" skill, which keeps it at the mostly-distinct anchor rather than minimal-conflict.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

bojieli/ai-agent-book

Path

skills/mcp-skill-hub/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.