Borrowing it
Nothing to install: this file belongs to enthouan/trello-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/enthouan/trello-mcp/main/.agents/skills/trello-mcp-live-validation/SKILL.mdgit clone --depth 1 https://github.com/enthouan/trello-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/enthouan/trello-mcp/trello-mcp-live-validation)<a href="https://agentmods.dev/skills/enthouan/trello-mcp/trello-mcp-live-validation"><img src="https://agentmods.dev/badge/skills/enthouan/trello-mcp/trello-mcp-live-validation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/enthouan/trello-mcp/trello-mcp-live-validation"><img src="https://agentmods.dev/badge/skills/enthouan/trello-mcp/trello-mcp-live-validation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.02661 |
| Opus 5 | $0.00044 | $0.01331 |
| Sonnet 5 | $0.00018 | $0.00532 |
| Haiku 4.5 | $0.00009 | $0.00266 |
Grade A, and why
trello-mcp-live-validation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Trello MCP Live Validation
Trigger And Scope
Use this skill when the user asks to run, verify, debug, or report live Trello MCP behavior against a real Trello board, including smoke checks, regression runs, broad "all tools" passes, and roadmap-board integration checks.
Do not use it for ordinary unit tests, static review, generic Trello API design, or offline script changes unless the user specifically asks for live MCP behavior.
Do not implement unrelated API coverage while following this skill. In particular, issue #40 cross-resource action audit tools are separate work.
Required Pre-Checks
Read the current checkout before live work:
git status --short --branch
corepack pnpm typecheck
corepack pnpm lint
corepack pnpm build
corepack pnpm test
If public tools or key inputs changed, regenerate the catalog and investigate any unexpected README diff:
corepack pnpm docs:tools
Live Safety Rules
- Never run live Trello validation from normal CI,
corepack pnpm test, or any command path that is not explicitly requested. - Never contact Trello unless the relevant live opt-in env vars, Trello credentials, and a board id or board URL are all set.
- Never log Trello API keys, tokens, credential-bearing URLs, raw env, raw request data, or full query strings.
- Treat only Trello board ids, short links, and
trello.com/b/...board URLs as valid board refs. Reject non-board URLs before logging their raw value or query string. - Use a board reserved for disposable validation artifacts. Do not mutate an active roadmap or production board unless the user explicitly confirms that board and accepts temporary artifacts there.
- Do not mutate existing cards, lists, labels, members, or custom fields except for read-only inspection. If a narrow reversible touch is unavoidable, verify restoration immediately.
- Prefix every temporary artifact with the script prefix or a stable manual marker such as
Codex MCP smoke test. - Treat a missing live env preflight failure as a valid skipped-live result when local credentials are unavailable.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 198 lines · 88 tokens per session scan A 00561eb5fd8d
trello-mcp-live-validation is a skill published in the GitHub repository enthouan/trello-mcp (4 stars, last pushed today), licensed MIT. It adds 88 tokens to every session and 2,661 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
atf-testing
Build ServiceNow Automated Test Framework tests and suites — impersonation, form steps, assertions, server-side script steps, test parameters, and execution via snowcreateatftest / snowexecuteatftest.
测试基础设施
A set of scripts that supports end-to-end testing, which checks a complete workflow across its connected parts. The scripts capture selected log messages, compare database snapshots, and record and verify notifications or other side effects.
deploy-verify
Deploy Server OS and run the official end-to-end verification suite.
playwright-skill
Generates production-grade Playwright automation scripts and E2E tests in TypeScript, JavaScript, Python, Java, or C#. Supports local execution and TestMu AI cloud across 3000+ browser/OS combinations and real mobile devices. Use when the user asks to write Playwright tests, automate browsers, run cross-browser tests…
playwright-cli
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
bat-adhoc
Run bot acceptance tests to validate MCP tools work correctly from a real AI agent's perspective. Use when testing PRs, detecting regressions, or verifying tool changes end-to-end with Claude/Gemini CLIs.