polygraph SKILL.md skillA
polygraph from cognitive-fab/polygraph is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add cognitive-fab/polygraph/polygraph@git:20260811.fb53d7ePins git:20260811.fb53d7e in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- cognitive-fab/polygraph
- Path
skills/polygraph/SKILL.md- Versions recorded
- 5
- Latest version
- git:20260811.fb53d7e, committed Aug 11, 2026
- First version recorded
- Jul 23, 2026
- Size
- 22,718 bytes
- Repository stars
- 15
- License
- Apache-2.0
A polygraph for your state machine. Audit a stateful piece of code end-to-end: YOU (the agent) instrument a copy, build any test doubles needed to run it, and capture real execution traces, then derive a transition-function spec from its source with an LLM (default artifact: a SAM v2 strict-profile module — named intents/schemas/domains, keyed acceptors, observable reject(reason), sealed model, next-state (prime) acceptors), replay the traces against it, model-check it against invariants, and…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Polygraph — a polygraph for your state machine Guide the user through a five-step, trace-driven consistency check. You (the in-session assistant) do the intelligent parts — designing the contract, instrumenting the code, capturing traces, and triaging findings. The bundled scripts do the mechanical parts — building the prompt, generating specs, replaying, and classifying. > **Tell the user this up front, once.** Disclosure: Polygraph is experimental, > not peer-reviewed, unproven technology — newly published and highly > speculative. It is a *consistency check, not a proof*: > a clean run means the code's observable behavior matches an independent > reading of its source, nothing more. "Exhaustive" means exhaustive over the > finite (action, data) domains the contract/module declares — data-dependent > behavior beyond those representative values is unchecked, and that > abstraction gap is not measured by any gate. Every finding is a lead to investigate by > hand, not an established result. Do not present it as a guarantee, and do not > let it be the only safeguard for correctness- or safety-critical code. …
Read the whole file at its exact version.
How to install
mdr add cognitive-fab/polygraph/polygraph@sha256:43d842740c6a1862The line at the top of this page pins the label git:20260811.fb53d7e, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_oaccv47czjfqf6o5)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Jul 23, 2026 and Aug 11, 2026, about one every 5 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260811.fb53d7e latest | 2026-08-11 | fb53d7e | 22,718 B | A | view · diff |
| git:20260807.2705388 | 2026-08-07 | 2705388 | 22,931 B | A | view · diff |
| git:20260725.c560fd1 | 2026-07-25 | c560fd1 | 22,249 B | A | view · diff |
| git:20260724.b7ad92a | 2026-07-24 | b7ad92a | 22,139 B | A | view · diff |
| git:20260723.f481c1d | 2026-07-23 | f481c1d | 21,510 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (22718 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
cognitive-fab/polygraph · 15 stars · license Apache-2.0 · pushed 2026-09-13 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_oaccv47czjfqf6o5 GET https://markdownregistry.com/api/v1/resolve?ref=cognitive-fab/polygraph/polygraph GET https://markdownregistry.com/api/v1/blob/43d842740c6a1862c56695d91c3894c0f3a59c199fcacf0734104787621fa65d
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from cognitive-fab/polygraph
Every file in cognitive-fab/polygraph