I run a directory where every agent skill gets evaluated on six dimensions — trigger quality, structure, workflow design, content, engineering, and security. Most skills are single prompts. This week a family of five landed that's engineered as a system — and it's the first family to score 10/10 on security in every member. Here's the breakdown.
Every so often something different lands in the skill ecosystem. Instead of another single-prompt wrapper, a family of five skills arrives — each doing one kind of judgment, designed to be composed.
That's Jev (471★, MIT, CI-tested, 108 documented scenarios). The repo's one-liner is the best summary: "Jev chooses, classifies and scores. Your agent supplies evidence and takes action."
That division of labor matters. These skills don't browse, don't execute, don't send anything. They make one specific decision well and hand it back — your agent owns the consequences.
1. jev-triage — 9.2/10
Classification and prioritization for inboxes, support tickets, feedback — especially bulk parallel judgments.
Why it leads the family: the smoke_test pattern. Before any bulk run, the host agent writes and validates a task-specific pilot on a few paired records, then scales up. That's the difference between "the model sorted 4,000 tickets" and "the model proved its labels on 20 tickets before touching 4,000." And it ends where it should: labels and review queues, not replies, not automatic mailbox changes.
The one thing: bulk judgment quality lives and dies on per-record context. Two-line ticket fragments referencing internal tools will defeat any skill.
2. jev-eval — 9.1/10
Judges outputs against explicit criteria — code-change reviews, rubric judgments, batch and multi-turn evaluation.
Why: this is the skill you want reviewing pull requests at scale: evidence-backed review leads tied to criteria you defined. The boundary is stated twice in the skill itself — not permission to merge or run targets. Engineering scored 10/10: the evaluation workflows ship with recorded input/output pairs you can inspect before trusting them.
The one thing: garbage criteria, garbage judgment. The skill is explicit that you own the rubric.
3. jev-documents — 8.6/10
Locates, extracts and verifies evidence in documents or code inventories — source-span extraction, passage reranking, claim checks.
Why: the honesty features are the value. It preserves citations (every claim traces to a span) and preserves no-match outcomes — when the evidence isn't there, it says so instead of confabulating a best-effort quote. Most extraction skills fail exactly here: they always find something.
The one thing: trigger quality is the family's lowest at 6/10 — it overlaps conceptually with jev-eval. Expect to call it by name.
4. jev — 8.6/10
The hub: design Jev-assisted workflows from the collected scenario library.
Why: bring it a workflow problem — "triage feedback, verify claims against docs, decide escalation" — and it assembles a pattern from 108 documented examples with 14 recorded input/output pairs. As a piece of skill authoring (progressive disclosure, reference indexes, customization guides) it's among the best I've evaluated.
The one thing: trigger quality 5.5/10, and that's inherent — it's a design-time skill you invoke deliberately, not a keyword-activated helper.
5. jev-act — 8.4/10
Chooses one legal next action in a browser, desktop, game or simulation.
Why: the safety architecture is clean. The skill only selects — "selection does not grant permission" — and the host executes and checks results. One action per call forces a fresh-observation loop instead of blind macro playback.
The one thing: the most niche member. Not building a browser agent or simulator? Skip it.
They compose into a pipeline
A support operation might run: jev-triage sorts the inbox → jev-documents pulls evidence from tickets and docs → jev-eval scores severity against your criteria → jev-act picks the next step inside your tooling. jev is how you'd design that workflow in the first place.
And the security story deserves its own line: 10/10 on all five members — a first in our evaluations. The boundaries are designed in ("labels, not replies"; "not permission to merge"; "selection does not grant permission"), and the family never both decides and executes. That separation is what agent-skill security should look like.
| Skill | Overall | Trigger | Structure | Workflow | Content | Engineering | Security |
|---|---|---|---|---|---|---|---|
| jev-triage | 9.2 | 7.5 | 10 | 9.6 | 9 | 9 | 10 |
| jev-eval | 9.1 | 7 | 9.3 | 9.6 | 9 | 10 | 10 |
| jev | 8.6 | 5.5 | 9.3 | 8.8 | 9 | 10 | 10 |
| jev-documents | 8.6 | 6 | 9.3 | 8.8 | 9 | 9 | 10 |
| jev-act | 8.4 | 5.5 | 9.3 | 8.4 | 9 | 9 | 10 |
The honest weak spot: trigger quality (5.5–7.5). These are primitives you call by name, not ambient helpers. Design choice, not sloppiness — but know what you're installing.
Install
curl -fsSL https://skill123.me/install/jev-triage.sh | bash
curl -fsSL https://skill123.me/install/jev-eval.sh | bash
curl -fsSL https://skill123.me/install/jev-documents.sh | bash
curl -fsSL https://skill123.me/install/jev.sh | bash
curl -fsSL https://skill123.me/install/jev-act.sh | bash
Or hand this to your AI assistant and let it do all five:
Install the following 5 skills by visiting each URL below and following its installation instructions:
- https://skill123.me/install/jev-triage
- https://skill123.me/install/jev-eval
- https://skill123.me/install/jev-documents
- https://skill123.me/install/jev
- https://skill123.me/install/jev-act
Start with jev-triage on a backlog you already understand — that's the fastest way to see what a judgment primitive buys you over prompting from scratch.
Top comments (2)
Evaluating skills on trigger quality, structure, workflow design, and security is a useful framing. The security score matters most when a skill can explain what it refuses and why, not just pass a static check. I would love to see how these results hold up under prompt injection and changing tool permissions.
Fair point — "explains what it refuses and why" is exactly the property I was scoring. The Jev family states its refusals in the skill text itself ("labels, not replies"; "not permission to merge"; "selection does not grant permission"), which is why I gave it straight 10s — but you're right that a written boundary isn't a tested one.
On prompt injection: the structural mitigation here is that these skills never both decide and execute, so an injected instruction inside a triaged record can at worst produce a bad label in a review queue — it can't act. That said, I haven't run an adversarial suite against them, and "skill that refuses" and "skill that resists" aren't the same score. I'll flag injection resistance as a follow-up dimension for the next family evaluation.