Skip to content

Back to the catalog

Skills Janitor
github.comrepo

Skills Janitor

Skills Janitor is a Claude Code/OpenAI Codex plugin that inventories installed skills, subagents, and MCP servers, then lets users swipe-delete unused or duplicate ones to reclaim context window space. Its janitor-security and janitor-discover commands scan skill contents for known prompt-injection shapes: instruction-override phrases, 'don't tell the user' directives, payloads hidden in HTML comments or zero-width unicode, smuggled base64, and scripts that pipe network output into a shell or read credential stores, citing research that found injection in roughly a third of tested community skills. It also cross-references MCP server configs against real session-transcript usage to flag connected-but-never-called servers whose tool schemas silently consume context on every request.

TL;DR CLI tool that triages and deletes unused Claude Code/Codex skills and MCP servers, with a built-in heuristic scanner for prompt-injection payloads hidden in skill files.
Open original ↗
Document

What it is

Skills Janitor (v1.8, September 2026) is an MIT-licensed plugin for Claude Code and OpenAI Codex with six commands. It needs Bash, Python 3 and curl, with no pip or node dependencies. The author has put it in maintenance mode: bug fixes and PRs are accepted, and no new features are planned.

Overlap with Claude Code built-ins

The README says Claude Code now covers the context-trimming core natively, with access to real usage from inside the harness:

  • /skill-doctor shows per-skill context cost and usage, and flags skills never invoked.
  • /doctor finds unused skills, MCP servers and plugins against their context cost, and fixes them after asking.
  • /doctor prompt-audit checks CLAUDE.md files, skills, agents and commands for outdated or conflicting instructions.
  • /skills sorts by token count (t) and hides a skill with Space.

The author recommends these for Claude Code-only users who just want to trim context. The plugin remains useful for what is not built in: security scanning, duplicate detection across skills, Codex support, and deleting broken symlinks and dead skill folders.

What to do

Install options:

/plugin marketplace add khendzel/skills-janitor
/plugin install skills-janitor
npx skills add khendzel/skills-janitor
git clone https://github.com/khendzel/skills-janitor ~/.claude/skills/skills-janitor

Security commands:

/janitor-security          # audit everything installed
/janitor-discover <url>    # overlap + security check BEFORE installing

The pre-install check in /janitor-discover is the main reason to keep the plugin, since it vets a skill before it enters the agent's trust boundary. Verdicts are PASS, REVIEW or RISK. The README says RISK means "read this before trusting it", not malware. On the author's 178-skill machine it flagged 2, both worth reading.

The swipe triage runs outside the Claude Code Bash tool, because the TUI needs real interactive stdin:

!bash ~/.claude/skills/skills-janitor/scripts/swipe.sh

Keys: left deletes, right keeps, down skips, u undoes, i inspects the full description, q quits.

What gets changed

  • User-scope skills are staged for deletion and removed only after a final y confirmation.
  • Plugin skills cannot be removed individually, so they are flagged for plugin review.
  • MCP servers swiped left are removed from their config file, with a timestamped .bak backup. Plugin-bundled servers are flagged for plugin review instead.
  • MCP usage is read from session transcripts (mcp__server__tool records) over the last 8 weeks. The report gives scope, call count, distinct tools called and last-used date. It states no token costs, because MCP schemas live server-side.
  • Duplicate detection scores description overlap with Jaccard similarity above 30%, so it catches re-implementations across user and plugin scopes that share no filename.

Caveats

The security scan is heuristic and targets known shapes only, so a PASS is not proof a skill is safe. The page does not give the source or citation for the "roughly a third" injection figure. The five v1.2 command aliases were removed in v1.5.

Technologies named here

Techniques named here

  • Prompt injection scanning in skills
  • MCP server usage cross-referencing
  • Duplicate/overlap detection via Jaccard similarity

Related in AI Security