openyida-cross-platform-release-guard SKILL.md skillA
openyida-cross-platform-release-guard from openyida/openyida is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add openyida/openyida/openyida-cross-platform-release-guard@git:20260908.580e115Pins git:20260908.580e115 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- openyida/openyida
- Path
.agents/skills/openyida-cross-platform-release-guard/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260908.580e115, committed Sep 8, 2026
- First version recorded
- Jul 28, 2026
- Size
- 4,174 bytes
- Repository stars
- 230
- License
- MIT
OpenYida 跨端发布风险守卫。当改动涉及浏览器/URL 拉起（openyida login、bridge 页面唤起、resolveBrowserLauncher、openBrowser、spawn 打开浏览器），或用户明确要求检查 Windows/Linux 发布风险时使用。用于静态扫描并拦截「cmd /c start 截断 URL」「open -n 假装开新窗口」等跨端问题；普通版本 tag 发布请使用 openyida-release。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# OpenYida 跨端发布风险守卫
macOS 本地测试跑通 ≠ 发布安全。浏览器/URL 拉起这类代码在 macOS 上正常，却可能在
Windows/Linux 用户侧直接炸掉——因为每个平台的浏览器拉起命令、URL 转义规则、默认浏览器
标识（bundle id / ProgId / .desktop）完全不同，而 CI 只跑纯函数单测，覆盖不到真实系统拉起。
## 触发条件
- 改动 `lib/auth/oauth-loopback.js`、`lib/bridge/bridge.js`，或任何 `resolveBrowserLauncher` /
`openBrowser` / `spawn(...浏览器...)` 相关逻辑。
- 在 macOS 开发、发布对象包含 Windows / Linux 用户。
- 用户明确要求对浏览器拉起或 URL 传递改动做跨端发布检查。
## 第一步：跑发布风险静态扫描（必做）
```bash
npm run check:release-risks
```
- **HARD 反模式 → exit 1，阻断发布**（已纳入 `check:ci` 第 10 步）：
- `cmd-c-start-url` / `cmd-c-start-argv`：`cmd /c start <url>` 会把 URL 里的 `&` 当命令
分隔符截断，丢失 `client_id`/`state`（登录）或 `oy_bridge_url`/`oy_bridge_token`（bridge）。
→ 改用 `rundll32 url.dll,FileProtocolHandler`，并复用 `resolveBrowserLauncher`。
- `open-n-url-new-tab`：`open -n <url>` 在 macOS 不会开新窗口，只在默认浏览器开新标签页
（假装开窗口）。→ 要真开新窗口须指定浏览器 App 并传其 `--new-window`/`-new-window`；
检测不到默认浏览器时回退纯 `open <url>`。
- **SOFT 提示 → 不阻断**：列出涉及浏览器/URL 拉起的文件，提醒补人工跨端验证。
扫描逻辑见 `scripts/check-release-risks.js`（纯静态扫描 `lib/`，会跳过注释，并正确识别字符串中的
`//` / `/*` 不是注释；命令字符串仍会保留扫描，确保能抓到 `spawn('cmd', ...)` 这类真实反模式）；
契约由 `tests/check-release-risks.test.js` 锁定。
## 第二步：跨端人工验证清单
…Read the whole file at its exact version.
How to install
mdr add openyida/openyida/openyida-cross-platform-release-guard@sha256:788acf32d3637a54The line at the top of this page pins the label git:20260908.580e115, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_44ii2vyewguc6xrh)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Jul 28, 2026 and Sep 8, 2026, about one every 42 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260908.580e115 latest | 2026-09-08 | 580e115 | 4,174 B | A | view · diff |
| git:20260728.2c22517 | 2026-07-28 | 2c22517 | 4,211 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4174 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
openyida/openyida · 230 stars · license MIT · pushed 2026-11-02 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_44ii2vyewguc6xrh GET https://markdownregistry.com/api/v1/resolve?ref=openyida/openyida/openyida-cross-platform-release-guard GET https://markdownregistry.com/api/v1/blob/788acf32d3637a54a346972d079c46930f41ee11f0a372734d9804482aada6c1
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.