airgap-vetting SKILL.md skillA
airgap-vetting from air-gapped/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add air-gapped/skills/airgap-vetting@git:20261027.4b5fb58Pins git:20261027.4b5fb58 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- air-gapped/skills
- Path
.claude/skills/airgap-vetting/SKILL.md- Versions recorded
- 3
- Latest version
- git:20261027.4b5fb58, committed Oct 27, 2026
- First version recorded
- Jul 14, 2026
- Size
- 14,809 bytes
- Repository stars
- 5
- License
- MIT
Vet an open-source product for air-gap readiness BEFORE adoption. Answers eight questions — telemetry, does-opt-out-actually-work, proxy-in-disguise over a hosted API, runtime downloads, custom-CA support, feature-level content egress / offline degradation, day-two sustainment (feed mirroring, staleness), and a 4-grade verdict (air-gap-native / possible-with-mirror / proxy-in-disguise / no-go). Two-pass: static grep of source + container image, then an optional dynamic harness…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# airgap-vetting Rapidly vet a candidate OSS product for air-gap readiness before adoption. Answers eight questions and assigns one of four grades. The organizing insight from the research behind this skill: **"documents an offline flag" ≠ "works offline"** — several tools fall back to downloading even with their own offline flag set, and the decisive distinction (*air-gap-native* vs *proxy-in-disguise*) is only provable by denying egress **after** activation and watching whether the product keeps working. **Arguments** (parse from `$ARGUMENTS`): - target (first positional, required): a product name (`meilisearch`), a local source checkout, a git URL, or a container image ref. Resolve whatever else is needed in Phase 0. - `--dynamic`: run the Phase-2 dynamic harness. Without it the vet is static-only and the verdict says so. - `--repo PATH` / `--image REF`: explicit source checkout / image when the positional target is ambiguous. - `--stakes low|high` (default `low`): `high` mandates the dynamic pass for any candidate that survives static; `low` allows a static-only provisional grade. Enforcement lives in the gate section. **The eight questions:** …
Read the whole file at its exact version.
How to install
mdr add air-gapped/skills/airgap-vetting@sha256:482f73d204c425b7The line at the top of this page pins the label git:20261027.4b5fb58, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_pb7s2zjlcxauafuv)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Jul 14, 2026 and Oct 27, 2026, about one every 52 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261027.4b5fb58 latest | 2026-10-27 | 4b5fb58 | 14,809 B | A | view · diff |
| git:20260818.24be5bd | 2026-08-18 | 24be5bd | 14,828 B | A | view · diff |
| git:20260714.249c215 | 2026-07-14 | 249c215 | 15,916 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (14809 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
air-gapped/skills · 5 stars · license MIT · pushed 2026-10-28 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_pb7s2zjlcxauafuv GET https://markdownregistry.com/api/v1/resolve?ref=air-gapped/skills/airgap-vetting GET https://markdownregistry.com/api/v1/blob/482f73d204c425b7a3f3a0bfeee16d4d1dd50c38bcf6b49349a465f5cdb9e221
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.