contribution-guardrails SKILL.md skillA
contribution-guardrails from camoa/claude-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add camoa/claude-skills/contribution-guardrails@v0.1.0Pins v0.1.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- camoa/claude-skills
- Path
drupal-ai-contrib/skills/contribution-guardrails/SKILL.md- Versions recorded
- 4
- Latest version
- v0.1.0, committed Jun 16, 2026
- First version recorded
- May 21, 2026
- Size
- 5,786 bytes
- Repository stars
- 32
- License
- MIT
Enforces the development discipline for AI-assisted Drupal contributions — evidence over assertion, the no-guessing rule for external facts, the verification-gate artifact contracts, and re-verification on post-gate change. Use PROACTIVELY during any development between claiming an issue and verifying it. Use when user says 'guardrails', 'evidence over assertion', 'no guessing', 'verify this fact', 'is this actually tested', or whenever AI-assisted code is being written for a Drupal…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Contribution Guardrails The cross-cutting discipline for AI-assisted Drupal contribution development. The recurring failure this prevents: AI claiming correctness it never verified. Drupal treats this as an existential review-cost problem — AI makes contributing cheap but makes *reviewing* expensive. ## When to Use - During any development between `/drupal-ai-contrib:issue` and `/drupal-ai-contrib:verify` - Before stating that anything "passes", "works", "is done", or "is secure" - When about to use an SDK symbol, API parameter, or version-specific behavior - NOT for: running the gates themselves (that is `contribution-verify`) ## Rule 1 — Evidence over assertion A gate passes **only on a produced artifact**. Never on the model stating a verdict. For each gate, *produce → capture → check the artifact*: | Gate | Pass artifact | |------|---------------| | Research | Cited findings — each claim traced to a source (dev-guide slug, vendor doc, source file) | | Implementation | TDD evidence — a failing test, then the same test passing (red → green) | | Static analysis | Clean **captured** `phpcs` / `phpstan` output — the actual command output, pasted | …
Read the whole file at its exact version.
How to install
mdr add camoa/claude-skills/contribution-guardrails@sha256:2f1b31a5b39447b7The line at the top of this page pins the label v0.1.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_hfjhtpul2nmpsivj)
7 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between May 21, 2026 and Jun 16, 2026, about one every 8 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v0.1.0 latest | 2026-06-16 | 8521501 | 5,786 B | A | view · diff |
| v0.1.0 | 2026-05-21 | e413083 | 5,755 B | A | view · diff |
| v0.1.0 | 2026-05-21 | 8a2d367 | 5,696 B | A | view · diff |
| v0.1.0 | 2026-05-21 | 8be3dad | 5,717 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5786 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
camoa/claude-skills · 32 stars · license MIT · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_hfjhtpul2nmpsivj GET https://markdownregistry.com/api/v1/resolve?ref=camoa/claude-skills/contribution-guardrails GET https://markdownregistry.com/api/v1/blob/2f1b31a5b39447b761513885bfab387686b393ce0f782b0eeed70002c8f7ac20
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.