tmb_cheatcode SKILL.md skillA
tmb_cheatcode from trustmybot/plugin is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add trustmybot/plugin/tmb_cheatcode@git:20261101.b2d4cebPins git:20261101.b2d4ceb in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- trustmybot/plugin
- Path
skills/tmb_cheatcode/SKILL.md- Versions recorded
- 7
- Latest version
- git:20261101.b2d4ceb, committed Nov 1, 2026
- First version recorded
- Jun 20, 2026
- Size
- 6,561 bytes
- Repository stars
- 6
- License
- MIT
When bro hits a wall — a task leans on a capability the project plainly lacks — and an existing published skill, MCP toolkit, or plugin would close the gap better than hand-rolled code. Bro names the gap, calls cheatcode_search for ranked candidates, judges which best fits this task and codebase, and recommends it for the Human to approve. Loaded when grabbing an external cheatcode beats grinding the capability out from scratch.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# cheatcode ## Already installed? When the Human refers to "cheatcode(s)" directly — "do the cheatcodes work", "which cheatcodes are installed", "is X already a cheatcode" — inspect the installed registry first with `cheatcode_list(agent='bro')` (the `cheatcodes` table). That's the read surface for what's on hand; it's distinct from the discovery pipeline below (search → vet → install), which is for closing a gap that nothing installed covers. Installed is not attached. A cheatcode the consuming agent can't use is still a gap — a skill missing from its `skills:`, or a tool such as `LSP` missing from its `tools:`. Close it with `cheatcode_approve` then `cheatcode_install(target=<agent>)`, and check the result's `attachments`. ## Is the gap real? Check the request against the project's surface — world model, installed skills/MCP, CLAUDE.md. It's a cheatcode play when: - The task needs a well-trodden domain with mature tooling (PDF extraction, OCR, a cloud SDK, a protocol client) and the project has nothing for it. - Building it in-repo would duplicate something the ecosystem already maintains. - The Human asked "is there a tool/skill for X." …
Read the whole file at its exact version.
How to install
mdr add trustmybot/plugin/tmb_cheatcode@sha256:68370b55bb801911The line at the top of this page pins the label git:20261101.b2d4ceb, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_jzwmjc4cupbadvrn)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 7 versions of this file, between Jun 20, 2026 and Nov 1, 2026, about one every 22 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261101.b2d4ceb latest | 2026-11-01 | b2d4ceb | 6,561 B | A | view · diff |
| git:20261026.b1dee64 | 2026-10-26 | b1dee64 | 5,940 B | A | view · diff |
| git:20261019.22de22a | 2026-10-19 | 22de22a | 5,936 B | A | view · diff |
| git:20260702.39f6614 | 2026-07-02 | 39f6614 | 5,916 B | A | view · diff |
| git:20260702.ce84493 | 2026-07-02 | ce84493 | 5,425 B | A | view · diff |
| git:20260620.13f36cd | 2026-06-20 | 13f36cd | 4,562 B | A | view · diff |
| git:20260620.9c5dd06 | 2026-06-20 | 9c5dd06 | 4,583 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6561 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
trustmybot/plugin · 6 stars · license MIT · pushed 2026-11-05 · branch dev
API
GET https://markdownregistry.com/api/v1/artifacts/art_jzwmjc4cupbadvrn GET https://markdownregistry.com/api/v1/resolve?ref=trustmybot/plugin/tmb_cheatcode GET https://markdownregistry.com/api/v1/blob/68370b55bb801911fb127c131e90170f27ead5b8a4d11e76d733854ce57f1128
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.