tmb-bro SKILL.md skillA
tmb-bro from trustmybot/plugin is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add trustmybot/plugin/tmb-bro@git:20260815.a2d60dePins git:20260815.a2d60de in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- trustmybot/plugin
- Path
adapters/codex/skills/tmb-bro/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260815.a2d60de, committed Aug 15, 2026
- First version recorded
- Aug 4, 2026
- Size
- 4,859 bytes
- Repository stars
- 6
- License
- MIT
Inspect a Git project with TMB's project-local inventory and world model, clarify a request, and capture an approved local planning issue plus Bro-authored decisions. Use only when the user explicitly invokes $tmb:tmb-bro for repository understanding or planning; stop before implementation, task orchestration, review, or delivery.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# TMB Bro
Use TMB as a bounded planning aid. Turn the user's intent and the selected Git
worktree into durable local context without starting implementation or changing
remote systems.
## Planning workflow
1. Determine the exact Git worktree the user wants to plan against. Pass its
absolute top-level path as `project_root` on every TMB call. Do not substitute
the MCP process working directory.
2. Call `runtime_initialize`. If it rejects the project, surface the named error
and stop; do not create `.tmb/`, edit `.gitignore`, or choose another project
implicitly.
3. Call `project_inventory`. If no repository is recorded or the model is stale
for this request, call `project_scan`, then read the inventory again.
4. Inspect the smallest useful slice of project context:
- use `world_model_search` to locate relevant areas;
- use `world_model_get` for the selected subtree;
- use Codex's normal read-only repository tools when source-level evidence is
necessary.
5. Separate evidence from assumptions. Ask the user when a missing product,
scope, or acceptance decision would materially change the plan.
…Read the whole file at its exact version.
How to install
mdr add trustmybot/plugin/tmb-bro@sha256:0748e4a48a61d57bThe line at the top of this page pins the label git:20260815.a2d60de, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_kyukovxjzi5w5hg6)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Aug 4, 2026 and Aug 15, 2026, about one every 5 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260815.a2d60de latest | 2026-08-15 | a2d60de | 4,859 B | A | view · diff |
| git:20260807.d272a51 | 2026-08-07 | d272a51 | 4,855 B | A | view · diff |
| git:20260804.4cbaba5 | 2026-08-04 | 4cbaba5 | 3,357 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4859 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
trustmybot/plugin · 6 stars · license MIT · pushed 2026-11-05 · branch dev
API
GET https://markdownregistry.com/api/v1/artifacts/art_kyukovxjzi5w5hg6 GET https://markdownregistry.com/api/v1/resolve?ref=trustmybot/plugin/tmb-bro GET https://markdownregistry.com/api/v1/blob/0748e4a48a61d57bf7cf90e831893e2baa912918de0c35b276739c067b153dc3
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.