extend-riot SKILL.md skillB
extend-riot from riot-org/riot is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add riot-org/riot/extend-riot@git:20261014.9c3854aPins git:20261014.9c3854a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- riot-org/riot
- Path
crates/riot-kernel/builtin/skills/extend-riot/SKILL.md- Versions recorded
- 4
- Latest version
- git:20261014.9c3854a, committed Oct 14, 2026
- First version recorded
- Aug 17, 2026
- Size
- 10,634 bytes
- Repository stars
- 22
- License
- a license file GitHub does not identify
用户想加技能、斜杠命令、hook、项目约定（AGENTS.md），或要给命令配 API key、密码这类机密时用。各扩展点的目录、格式限制和优先级规则。MCP 服务器转 add-mcp，打成可分发的插件转 create-plugin。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 扩展 Riot
技能、命令、hook 是普通文件，改完**下一轮对话生效**，不用重启。AGENTS.md
只在会话第一条消息注入，改完要**新开会话**才看得到。MCP 服务器在
`config.json` 里，规矩不同，用 `add-mcp` 技能。
全局的放配置目录（`<配置目录>`），项目级的放 `<项目>/.riot/`。同名时
**项目级赢**（和 git 的 local > global 同一直觉）。`<配置目录>` 是：
- 设了 `XDG_CONFIG_HOME`（任何平台，含登录 shell 里 export 的）→
`$XDG_CONFIG_HOME/riot`
- 否则 macOS `~/Library/Application Support/riot`、Linux `~/.config/riot`、
Windows `%APPDATA%\riot`
拿不准就 `echo $XDG_CONFIG_HOME` 看一眼，或让用户到设置 → 关于里看。
放哪一层：只给用户自己用、跨项目通用的放全局；跟这个仓库走、要提交给
团队的放项目级。用户没说就问，别替用户选。
写 `<项目>/.riot/` 下的文件会弹「修改 agent 配置」的确认，「全部放行」也
跳不过，每次写都弹。动手前跟用户说一声这是正常的，免得被当成异常点了拒绝。
插件带的技能和命令排在全局之后、内置之前，且自动带 `<插件>:` 前缀 —— 要
把这些东西打包给别人装、或从 Claude Code / Cursor 的插件里搬过来，用
`create-plugin` 技能。
## 技能 SKILL.md
```text
<配置目录>/skills/<名字>/SKILL.md 全局
<项目>/.riot/skills/<名字>/SKILL.md 项目级
```
```markdown
---
name: verify
description: 改完代码要验证时用。按分层防线依次跑。
disable-model-invocation: false
---
正文。可用 $ARGUMENTS 和 ${SKILL_DIR}。
```
限制（这些都是模型猜不到的）：
- **frontmatter 必须有**（和命令不同）：不以 `---` 开头、或正文为空，都算
「有问题的技能」报给设置页。`name` 可省，省了取目录名。
- **`description` 必填**，缺了不静默跳过，同样报给设置页。
它是模型决定要不要加载的唯一依据。
- **`description` 硬顶 250 字符**。超了会被截断，模型就是在残句上做判断。
写不下就说清「什么时候用」，别写做法——做法在正文里。
…Read the whole file at its exact version.
How to install
mdr add riot-org/riot/extend-riot@sha256:afe0ca10ac381a45The line at the top of this page pins the label git:20261014.9c3854a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_lgtawaxynpcz52ce)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between Aug 17, 2026 and Oct 14, 2026, about one every 19 days. Its first recorded version is graded A and its latest B.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261014.9c3854a latest | 2026-10-14 | 9c3854a | 10,634 B | B | view · diff |
| git:20260913.5e905fe | 2026-09-13 | 5e905fe | 6,344 B | A | view · diff |
| git:20260909.c229f9f | 2026-09-09 | c229f9f | 6,070 B | A | view · diff |
| git:20260817.d4dfa41 | 2026-08-17 | d4dfa41 | 5,906 B | A | view |
Audit of the latest version
- fail: No instruction to read or print local credentials (matched: cat .env)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10634 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
riot-org/riot · 22 stars · license a license file GitHub does not identify · pushed 2026-10-29 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_lgtawaxynpcz52ce GET https://markdownregistry.com/api/v1/resolve?ref=riot-org/riot/extend-riot GET https://markdownregistry.com/api/v1/blob/afe0ca10ac381a4504c5481d662602a4aa46e7c327418405a71c8ffa12a46f90
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.