Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nimbly-dev/mcp-java-dev-tools/mcp-java-dev-tools-security-plan-crafternpx skills add nimbly-dev/mcp-java-dev-tools --skill mcp-java-dev-tools-security-plan-craftergit clone --depth 1 https://github.com/nimbly-dev/mcp-java-dev-toolsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00045 | $0.00767 |
| Opus 5 | $0.00023 | $0.00383 |
| Sonnet 5 | $0.00009 | $0.00153 |
| Haiku 4.5 | $0.00005 | $0.00077 |
Grade A, and why
mcp-java-dev-tools-security-plan-crafter scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
The source is not reproduced here
No licence file
A repository with no LICENSE is all rights reserved by default, so the body is not copied here. The metadata, the measurements and the link are.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 36 lines · 45 tokens per session scan A 30c27c382981
mcp-java-dev-tools-security-plan-crafter is a skill published in the GitHub repository nimbly-dev/mcp-java-dev-tools (2 stars, last pushed yesterday), with no licence file. It adds 45 tokens to every session and 767 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
evergreen
Evergreen CI infrastructure, configuration validation. Use when modifying .evergreen/ config, preparing to submit changes or understanding the Evergreen test matrix.
sync-agents-docs
Sync AGENTS.md files, skills, and references after buildSrc or convention changes. Use after modifying build plugins, formatting rules, testing conventions, or task names to keep documentation consistent.
ai-article
AI 类文章撰写。三种风格：安装教程、产品评测、面试八股。覆盖 AI Coding 工具实测、AI 开发框架应用、大模型测评、Agent/Skills/RAG 技术讲解。.
job-article
根据指定选题，按照二哥的写作风格完成求职/校招/面试/职场类文章撰写。专注于秋招春招建议、公司薪资爆料+学习路线、面经八股解析、求职心态与球友故事分享。触发关键词：写一篇求职文章、秋招、春招、校招、offer、面经、薪资、面试、八股、简历、求职建议、球友故事、学习路线等。.
video-cover-image
Generate matched 3:4, 16:9, and 4:3 short-video cover images from toBeBetterJavaer video scripts or AI/Java technical topics. Use when the user asks for 视频封面, 封面图, 横版和竖版, 小红书/抖音/B站/快手封面, pure-text covers with 白色大字+黄色小字, reference-image-matched covers, or wants a repeatable cover workflow for Markdown scripts under…
video-script
为短视频/口播生成或优化脚本。适用于 AI 技术科普、Agent/Skill/RAG 等技术概念讲解、工具实测、热点拆解类短视频。支持两种模式：给定主题从零产出口播稿、对已有口播稿进行优化。触发关键词包括：口播、口播稿、视频脚本、短视频文案、录视频、拍视频、video script。.