Skip to content
Back to skills

Lean Builtin Tool Auditor

ASecurity

Audit builtin MCP tool implementations in LibrAgent for schema accuracy, minimal complexity, and non-bloated hints. Use when reviewing builtin tools for compliance, validating tool schemas, checking for over-engineering, or ensuring next-action hints are concise and relevant.

  • 12 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 28, 2026
ai-agentsrust

Works with

  • mcp

Security analysis

A100/100

Scanned September 28, 2026

npx -y skills add fritzprix/libr-agent --skill lean-builtin-tool-auditor --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Lean Builtin Tool Auditor?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Lean Builtin Tool Auditor
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/fritzprix-lean-builtin-tool-auditor/badge)](https://www.skillsdirectory.com/skills/fritzprix-lean-builtin-tool-auditor)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md
---
name: lean-builtin-tool-auditor
description: Audit builtin MCP tool implementations in LibrAgent for schema accuracy, minimal complexity, and non-bloated hints. Use when reviewing builtin tools for compliance, validating tool schemas, checking for over-engineering, or ensuring next-action hints are concise and relevant.
---

# Lean Builtin Tool Auditor

Audit builtin MCP tools against three principles: correct schemas, no over-engineering, minimal relevant hints.

## 1. Schema Correctness

Tool schemas must be accurate and complete.

**Check:**

- [ ] Parameters have correct types (string, number, boolean, object, array)
- [ ] Required fields are marked required
- [ ] Descriptions are clear and actionable for AI agents
- [ ] No redundant or unused parameters
- [ ] Enum values are exhaustive and correct
- [ ] Default values are safe and sensible

**Anti-pattern:**

```rust
// ❌ WRONG: Vague type, missing required, unclear description
props.insert("path".to_string(), string_prop(
    None, None,
    Some("file location")
));

// ✅ CORRECT: Explicit type, required, actionable description
props.insert("path".to_string(), string_prop(
    Some(1), Some(255),
    Some("Absolute or relative path to target file")
));
```

## 2. No Over-Engineering

Keep implementations simple and maintainable.

**Check:**

- [ ] No alias proliferation (one canonical name per tool)
- [ ] No unnecessary wrapper functions or indirection
- [ ] No over-generalized helpers that obscure logic
- [ ] Error handling is direct, not wrapped in multiple layers
- [ ] No premature abstraction for one-off cases

**Anti-pattern:**

```rust
// ❌ WRONG: Alias error hints bloat
match tool_name {
    "readFile" => self.handle_read_file(...),
    "read_file" | "read" => Ok(MCPResult::error("Did you mean 'readFile'?")),
    _ => Err(format!("Tool '{}' not found", tool_name)),
}

// ✅ CORRECT: Simple match, agent learns from schema
match tool_name {
    "readFile" => self.handle_read_file(...),
    _ => Err(format!("Tool '{}' not found", tool_name)),
}
```

## 3. Hints Without Bloat

Next-action and recovery hints must be required, relevant, and concise.

**Check:**

- [ ] Success hints only when agent needs guidance
- [ ] Error hints include 1-2 specific recovery steps
- [ ] No generic "Use toolX to do Y" when toolX is obvious
- [ ] No redundant hints already in message body
- [ ] No edit-promotion padding on read-only tools
- [ ] Hint text is copy-pasteable (includes exact parameters)
- [ ] Hints are **outcome-conditioned**: steady path stays empty/minimal; phase boundaries may escalate once; repeated failures escalate instead of repeating the same retry

**Exception (not bloat):** State-gated escalation after a milestone or stuck loop is intentional augmentation. Fixed "always promote sibling tool X" on every call is bloat.

**Anti-pattern:**

```rust
// ❌ WRONG: Bloated success hints on read-only tools
let hint = SuccessHint::new(
    format!("Directory listing for '{}':\n\n{}", path, listing),
    vec![
        format!("Use readFile('{}/filename')", path),
        format!("Use listDirectory('{}/subdir')", path),
        "Use search to find content".to_string(),
    ]
);

// ✅ CORRECT: Data speaks for itself
let hint = SuccessHint::new(
    format!("Directory listing for '{}':\n\n{}", path, listing),
    vec![]  // Only add hints when agent actually needs next step
);
```

**Anti-pattern:**

```rust
// ❌ WRONG: Vague error recovery
return Err("Operation failed".to_string());

// ✅ CORRECT: Specific recovery
return Err(format!(
    "Process '{}' not found. Use listProcesses() to find active processes.",
    process_id
));
```

## Audit Workflow

1. Read the tool schema (`mod.rs` or `tools/*.rs`)
2. Read the handler implementation
3. Read response building code for hints
4. Check each dimension above
5. Report only high-confidence issues

## Reference

For full design standard, see `docs/guides/builtin_tool_bp.md`.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

View all in ai-agents →

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.