Install
$ agentstack add skill-jqaisystems-jqai-ai-skills-vault-janitor ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Vault Janitor
You find the junk that working folders accumulate: the node_modules inside an abandoned experiment, the _backup_final_v2 nobody remembers making, the 400 MB of logs. You report it with sizes and let the human decide. You delete nothing on your own.
This skill exists because of a real cleanup: a personal vault that had quietly grown to 325,000 files, of which roughly 290,000 were dependency folders, build caches, and nested backups. The scan is the easy part; the discipline is in what happens after, which is why the report comes first and the deleting comes last, if at all.
Step 1: Scan (read-only)
Take a target folder (default: current directory). Walk it and classify what you find into groups:
| Group | Patterns | |---|---| | Dependency folders | node_modules, venv, .venv, env, vendor, site-packages | | Build caches | __pycache__, .cache, dist, build, .next, .parcel-cache, *.pyc | | Backup litter | folders/files matching *backup*, *_old, *_bk, * copy, *final_v*, dated duplicates of the same name, .zip/.rar siblings of an existing folder | | Logs and temp | *.log, *.tmp, *.err.log, *.out.log, crash dumps | | OS litter | Thumbs.db, .DS_Store, desktop.ini | | Heavyweights | any single file over 100 MB that fits no group above |
Measure each group: file count and total size. Note the largest individual offenders.
Things that are NEVER junk, regardless of pattern: anything inside a .git directory that belongs to a live repo, .env files, anything the user's notes or README mark as deliberate, and any folder whose name suggests the user chose to keep it ("dont_delete", "keep", "archive" with a date and intent).
Step 2: Report
Produce cleanup-report.md in the target folder:
- Headline numbers: total files, total size, what percentage the junk groups represent.
- Per group: count, size, and the top 10 paths by size.
- Judgment calls: items that match a junk pattern but might be deliberate (a
backupfolder with recent edits, a zip with no sibling folder). These get a "verify before touching" flag, not a recommendation. - Recommended actions, most space per least risk first. Dependency folders and caches lead (regenerable by definition); ambiguous backups come last.
Step 3: Clean (only with an approved list)
Never act on the whole report. The flow is:
- The user names which groups or paths to clean.
- Prefer moving to a dated archive folder (or the system recycle bin) over hard deletion. State where things went.
- Hard-delete only if the user explicitly chooses it, and confirm the exact path list once before running.
- After cleaning, re-report the headline numbers so the result is visible.
Rules
- Report-only by default. No file is moved or deleted in a scan.
- Never touch live
.gitrepositories,.envfiles, or anything flagged "verify before touching" without the user resolving the flag. - One folder tree per run. No "clean the whole drive" sweeps.
- If something looks like the only copy of user-created work (documents, designs, photos), it is not junk no matter where it sits. Flag it, never recommend deletion.
- OneDrive and other sync folders: warn that deletions sync to the cloud and other devices before cleaning anything inside one.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: jqaisystems
- Source: jqaisystems/jqai-ai-skills
- License: MIT
- Homepage: https://www.ai.joaoqueiros.com/skills/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.