dont-fall-in-love-with-the-bug SKILL.md skillA
dont-fall-in-love-with-the-bug from annatchijova/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add annatchijova/skills/dont-fall-in-love-with-the-bug@git:20260901.c9a31f8Pins git:20260901.c9a31f8 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- annatchijova/skills
- Path
dont-fall-in-love-with-the-bug/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260901.c9a31f8, committed Sep 1, 2026
- Size
- 3,182 bytes
- Repository stars
- 9
- License
- a license file GitHub does not identify
Do not stop at a reproducible symptom — the gate that makes you earn the report before writing it. Name the broken invariant and its layer, sweep for variants, attack the fix you expect the maintainer to ship, map the real blast radius across shipped clients and versions, and calibrate severity against a named comparable advisory. Use whenever a finding is labeled CONFIRMED or EXPLOITABLE, a bounty report is being drafted or reviewed, or an obvious one-line fix is being assumed. Trigger on 'it…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Don't fall in love with the bug The failure mode this prevents: you stop at the symptom, submit, and the maintainer does the variant/bypass pass you skipped — finding more than you reported. A confirmed repro is the *middle* of the work, not the end. This gate makes the agent earn the report. ## Trigger A finding is reproducible and about to be written up or submitted; a result is labeled CONFIRMED/EXPLOITABLE; a bounty report is being drafted or reviewed; or an "obvious" one-line fix is being assumed. ## Steps (the gate — do not draft the report until each is answered) 1. **Root cause vs symptom.** Name the invariant that is actually broken, and at what layer. If you can only describe *what happens*, not *what guarantee fails*, you are still at the symptom — keep going. 2. **Variant sweep.** Same invariant, other call sites / headers / params / entry points. Run `variant-analysis`. List what you checked, *including* the ones that did not reproduce. …
Read the whole file at its exact version.
How to install
mdr add annatchijova/skills/dont-fall-in-love-with-the-bug@sha256:12271ad0ecacefb2The line at the top of this page pins the label git:20260901.c9a31f8, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_oqx6mlgqrrng6khw)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 1, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (3182 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
annatchijova/skills · 9 stars · license a license file GitHub does not identify · pushed 2026-11-02 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_oqx6mlgqrrng6khw GET https://markdownregistry.com/api/v1/resolve?ref=annatchijova/skills/dont-fall-in-love-with-the-bug GET https://markdownregistry.com/api/v1/blob/12271ad0ecacefb24deb13a2f1b4238aea2266aff3f368a1854c18c88de9c60f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.