Use when adding CI/CD, creating workflows, auditing GitHub Actions, or fixing action pinning. Creates and audits workflows for SHA pinning and permissions.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
## Mode Detection
Audit and report by default. Generate workflows only when asked to create, add, or set up CI — and **never merely because `.github/workflows/` is absent**; report that none were found instead. Apply fixes only when asked to fix or pin. When the ask is unclear, report and offer to apply the fixes.
## Create Mode
### 1. Detect Project Type
Scan for project indicators:
- `package.json` → Node.js/JS/TS
- `go.mod` → Go
- `requirements.txt` / `pyproject.toml` / `setup.py` → Python
- `Cargo.toml` → Rust
- `Gemfile` → Ruby
### 2. Detect Package Manager (JS/TS projects)
Detect the package manager from the lockfile, in this order: `nub.lock`, `pnpm-lock.yaml`, `bun.lock`/`bun.lockb`, `yarn.lock`, `package-lock.json`. With no lockfile, ask.
…
The line at the top of this page pins the label git:20261017.549351f, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.
pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (5771 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag
Source
GitHub
tartinerlabs/skills · 8 stars · license MIT · pushed 2026-11-06 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_rkgj3w762nxb45kv
GET https://markdownregistry.com/api/v1/resolve?ref=tartinerlabs/skills/github-actions
GET https://markdownregistry.com/api/v1/blob/9e7d13a0edee57b1da4c5fe34dd3d178d25af0f63f113bda2234e080f43f5b1a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
tartinerlabs/skills · plugins/design/skills/accessibility/SKILL.md · Use when building or reviewing UI for accessibility — screen readers (VoiceOver, TalkBack), keyboard and focus, colour…
tartinerlabs/skills · plugins/design/skills/apple-featuring/SKILL.md · Use when preparing an Apple platform app for App Store featuring or the Apple Design Awards — readiness reviews before…
tartinerlabs/skills · plugins/design/skills/ux-psychology/SKILL.md · Use when designing, building, or reviewing a screen, flow, or page — landing and marketing pages, onboarding, sign-up…
tartinerlabs/skills · plugins/design/skills/visual-design/SKILL.md · Use when choosing or reviewing how a screen, flow, or page looks — colour palette, typography, spacing, cards and…
tartinerlabs/skills · plugins/quality/skills/i18n/SKILL.md · Use when internationalising or localising an app, preparing it for translation, extracting hardcoded strings, adding…
tartinerlabs/skills · plugins/quality/skills/project-structure/SKILL.md · Use when deciding where code should live, organising files, or auditing project structure. Checks colocation, grouping…
tartinerlabs/skills · plugins/security/skills/deps/SKILL.md · Use when hardening a dependency supply chain, pinning versions, adding registry/security flags, or setting up Renovate…
tartinerlabs/skills · plugins/security/skills/security/SKILL.md · Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. Dependency…
tartinerlabs/skills · plugins/tooling/skills/setup/SKILL.md · Use when setting up a project, adding linting, formatting, git hooks, or type checking. Detects the language and…
ericrisco/rsc-harness · skills/github-actions/SKILL.md · Use when authoring or fixing GitHub Actions CI/CD — workflows under .github/workflows, triggers, job matrix, caching…
openhands/extensions · skills/github-actions/SKILL.md · Create, debug, and test GitHub Actions workflows and custom actions. Use when building CI/CD pipelines, automating…
nahid-sparktales/agent-dispatcher · skills/devops/github-actions/SKILL.md · Write and review GitHub Actions workflows that fail honestly and finish fast enough to be trusted — least-privilege…
opensourceagi/dev-tools-starter-agent · skills/github-actions/SKILL.md · How to set up the GitHub Actions workflows from the qwksearch reference CI — a discovered per-package test matrix with…
