hyrums-law SKILL.md skillA
hyrums-law from the-artificer-of-ciphers-llc/skills-from-the-artificer is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add the-artificer-of-ciphers-llc/skills-from-the-artificer/hyrums-law@git:20260530.3e17152Pins git:20260530.3e17152 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- the-artificer-of-ciphers-llc/skills-from-the-artificer
- Path
hyrums-law/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260530.3e17152, committed May 30, 2026
- Size
- 4,052 bytes
- Repository stars
- 6
- License
- MIT
Apply Hyrum's Law when discussing API design, backward compatibility, deprecation, versioning, or any situation where a system has enough users that its observable behavior—not just its documented interface—has become depended upon. Trigger on phrases like "can we change this behavior?", "is this a breaking change?", "users are depending on a bug we fixed", "we want to deprecate this", or any discussion about evolving a public or widely-used API. Hyrum's Law is essential reading for anyone…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Hyrum's Law > "With a sufficient number of users of an API, it does not matter what you promise in the contract: all observable behaviors of your system will be depended on by somebody." > — Hyrum Wright, 2012 ## The core idea If enough people use your API, every behavior — documented or not, intentional or not, even bugs — will be depended upon by someone. Your documented interface is not the real interface. The real interface is everything observable: response times, error message text, ordering of results, whitespace in JSON output, HTTP headers, memory usage patterns. This has a humbling implication: **as an API grows, your ability to change anything without breaking someone approaches zero.** ## Why it matters When you're building for a small set of users, you can coordinate changes. When your API is used by thousands of developers, you can't know what they've built. Some of them will have: - Parsed your error messages with regex - Depended on the alphabetical ordering of a field that you return in hash order - Built retry logic around your specific timeout behavior - Cached responses based on headers you didn't intend to be cacheable …
Read the whole file at its exact version.
How to install
mdr add the-artificer-of-ciphers-llc/skills-from-the-artificer/hyrums-law@sha256:ee6a096dda4d5744The line at the top of this page pins the label git:20260530.3e17152, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_4dzwehlquybba6jb)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on May 30, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4052 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
the-artificer-of-ciphers-llc/skills-from-the-artificer · 6 stars · license MIT · pushed 2026-11-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_4dzwehlquybba6jb GET https://markdownregistry.com/api/v1/resolve?ref=the-artificer-of-ciphers-llc/skills-from-the-artificer/hyrums-law GET https://markdownregistry.com/api/v1/blob/ee6a096dda4d5744cba19c74a73a9e423e90e07d8e855d2248ad0f6b18222d3f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from the-artificer-of-ciphers-llc/skills-from-the-artificer
Every file in the-artificer-of-ciphers-llc/skills-from-the-artificer