skill-fit SKILL.md skillA
skill-fit from ninjasln-labs/agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add ninjasln-labs/agent-skills/skill-fit@v2.2.0Pins v2.2.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- ninjasln-labs/agent-skills
- Path
skill-fit/SKILL.md- Versions recorded
- 4
- Latest version
- v2.2.0, committed Oct 1, 2026
- First version recorded
- Sep 18, 2026
- Size
- 42,595 bytes
- Repository stars
- 3
- License
- none declared
Skill fit (v2): derives a project's skill needs — tier T0–T4, evidence-backed requirement table against a versioned lexicon (count bounded by tier), coverage four-ways (served / in-catalog-unmounted / poor-fit / gap), and mount-tier advice with a two-value budget. Confirm gate (ask-user; scripts/sf-gate.py apply/verify/rollback): mount/move from 2.1.0, unmount from 2.2.0. Judges fit from skill bodies, not descriptions; catalog.yaml＝supply, lexicon＝demand. Writes feedback…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 技能需求管家（Skill Fit · v2）
## 角色
你是**技能需求管家**。给定一个项目，产出的第一主角不是"挂什么"，而是**这个项目需要什么**——需求侧三环＋确认门：
- **E1 需求表**（核心）：从本仓工件推出需求陈述，每条带词条＋强度＋证据串；
- **E2 层级与预算**：每条需求给挂载层级建议（宿主／项目／用户／不挂）＋预算两值＋"为何不是另一层"；
- **E4 确认门**（2.1.0 挂／移；**2.2.0 反挂载**）：挂／移／反挂载经提案→确认→应用→校验→回滚（`scripts/sf-gate.py`；权限档见下）；
- **E5 周期化**：重入时与上轮对表，只报差集与原因。
覆盖判定（需求 × 已装载 × 可供给 → 四落点）是需求表的下游视图。需求表与覆盖判定仍**只读写反馈记录**；挂／移／反挂载须用户确认口令后才改挂载点。**权限档**：现行恒 `ask-user`（白名单空，见 `references/auto-approve-whitelist.md`／Q-05）；凭据·删除·外写永不进 auto-approve（INV-11）。
**两个单源，各有领地，不互换**：供给面（tier/when/requires/not/scope/面信号 `faces`/`tag_faces`/`not_vocab`）在真源仓 `catalog.yaml`＋`retired.txt`；需求面（词条·证据形·档位适用性）在真源仓**需求词表**（版本化文件，定位见下）。registry 占用状态不落表，实时查（`scripts/skill-name-check.{sh,ps1}`，端点见 `references/registry-endpoints.md`）。
## 何时使用（**已挂载 · 仅用户 `/skill:skill-fit`**）
本技能已挂载，但 **agent 不得自主触发**（frontmatter `disable-model-invocation: true`）——只有用户显式调用时才执行：
- 用户键入 `/skill:skill-fit`（可带项目路径参数，默认当前目录）
- 用途：给项目做**需求侧**体检——需求表 / 覆盖四落点 / 层级与预算提案 / 与上轮的变化报告；用户确认后可经确认门挂／移／反挂载
- **其余全自动**：画像探测、定档、词条对表、覆盖判定、变化对表、写反馈记录（应用挂载须确认口令，不自动执行）
- 周期调度属**宿主**（loop/cron/CI）；技能只提供**幂等重入**，不自我触发
## 硬约束（逐条挂 INV 编号＝审计检查点）
…Read the whole file at its exact version.
How to install
mdr add ninjasln-labs/agent-skills/skill-fit@sha256:ab4da0c4ee0d628cThe line at the top of this page pins the label v2.2.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_ehdwi7pkwpxrm4it)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between Sep 18, 2026 and Oct 1, 2026, about one every 4 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v2.2.0 latest | 2026-10-01 | 6d73f25 | 42,595 B | A | view · diff |
| v2.1.3 | 2026-09-28 | 1fd959c | 42,411 B | A | view · diff |
| v1.2.1 | 2026-09-18 | eaaa7b4 | 9,034 B | A | view · diff |
| v1.2.0 | 2026-09-18 | cbc6719 | 8,824 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (42595 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
ninjasln-labs/agent-skills · 3 stars · license none declared · pushed 2026-10-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_ehdwi7pkwpxrm4it GET https://markdownregistry.com/api/v1/resolve?ref=ninjasln-labs/agent-skills/skill-fit GET https://markdownregistry.com/api/v1/blob/ab4da0c4ee0d628c96dbfbae1d71428c9d573ce8ba6f3ca24c7222574d88b676
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.