spike-and-validate SKILL.md skillA
spike-and-validate from edbertchan/catstack is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add edbertchan/catstack/spike-and-validate@git:20260909.2dc9a9fPins git:20260909.2dc9a9f in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- edbertchan/catstack
- Path
product/skills/spike-and-validate/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260909.2dc9a9f, committed Sep 9, 2026
- Size
- 3,139 bytes
- Repository stars
- 6
- License
- none declared
Turn an untested assumption into real output by building the smallest throwaway that would kill it, running it, then discarding the code and keeping the finding. Use before committing to an invented option, an unfamiliar library or API, or a performance assumption. The gate on `alternatives-considered`.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Spike and validate A spike is an experiment, not a draft of the real change. Its only product is a run with real output. The code goes in the bin. This is the gate that makes `alternatives-considered` safe: an option nobody ran is a hypothesis, and a spike is the cheapest way to stop it from becoming a decision. ## Step 1. Write the kill condition first Before any code, in one line: **what result would rule this out?** If you cannot write that line, you are not spiking, you are starting the implementation. Stop and say so. The kill condition is falsifiable and specific. "See if the library works" is not one. "Parses our 40MB fixture in under 2s on this machine" is. ## Step 2. Build the smallest thing that could fail - Own worktree or scratch directory. Never the live checkout. - Hardcode everything not under test. Config, auth, error handling, and edge cases are not what you are learning. - No tests, no cleanup, no comments. This code is not going to review. - Timebox it and say the box out loud. A spike that outgrows its box has become the implementation without anyone deciding that. ## Step 3. Run it and paste the output …
Read the whole file at its exact version.
How to install
mdr add edbertchan/catstack/spike-and-validate@sha256:38e350e30ec9d642The line at the top of this page pins the label git:20260909.2dc9a9f, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_mplph4fwu34nqrvf)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 9, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (3139 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
edbertchan/catstack · 6 stars · license none declared · pushed 2026-10-22 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_mplph4fwu34nqrvf GET https://markdownregistry.com/api/v1/resolve?ref=edbertchan/catstack/spike-and-validate GET https://markdownregistry.com/api/v1/blob/38e350e30ec9d642346c43346f58c6a9c8eb66333aa026f9ac3c754c14453d29
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.