verify SKILL.md skillA

verify from riot-org/riot is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned

mdr add riot-org/riot/verify@git:20261014.9c3854a

Pins git:20261014.9c3854a in mdr.lock. Pin the fingerprint instead.

Audit grade: A, 17 of 17 checks passed
Kind: SKILL.md skill
Repository: riot-org/riot
Path: crates/riot-kernel/builtin/skills/verify/SKILL.md
Versions recorded: 2
Latest version: git:20261014.9c3854a, committed Oct 14, 2026
First version recorded: Aug 17, 2026
Size: 3,141 bytes
Repository stars: 22
License: a license file GitHub does not identify

改完代码要验证时用。先从 CI 配置和构建脚本摸清这个项目把什么当作「过了」，再按静态检查、测试、真跑一遍的顺序执行。别把「编译过了」当成「验证过了」。.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# 验证一次改动

「编译过了」「测试绿了」「真的工作」是三件事。每层拦的问题不一样，
只做第一层等于没验证——值得担心的 bug 基本都是「编译通过、类型正确、
看起来合理」的那种。

## 0. 先摸清这个项目的防线是什么

不要凭直觉猜命令，按顺序找：

1. **CI 配置**（`.github/workflows/`、`.gitlab-ci.yml` 之类）——CI 跑
   什么，本地就跑什么。CI 是这个仓库对「验证过了」的正式定义，本地跑的
   和 CI 不一致，本地全绿也不算数。
2. **构建脚本**：`package.json` 的 scripts、`Makefile`、`justfile`、
   `Cargo.toml`、`pyproject.toml`。`[约束]` 优先用仓库自己包好的入口
   （`npm run test` 而不是自己拼测试框架的参数）——包装里经常藏着必要
   的环境变量和 flag，绕开它跑出来的结果不可比。
3. **AGENTS.md / CONTRIBUTING.md** 里写明的验证要求。

## 1. 静态检查（最快，先跑）

typecheck、lint、fmt --check。秒级出结果，排最前面是为了 fail fast——
类型都不对就不用花几分钟等测试了。

## 2. 测试

- 大仓库先跑**和改动相关的子集**（按文件或模块过滤），过了再考虑要不要
  全量。上来就全量，反馈周期动辄十几分钟。
- `[约束]` 测试红了先分清：是这次改动弄红的，还是本来就红？在一个
  临时 worktree 里对着改动前的提交重跑那几个测试：

  ```bash
  git worktree add --detach /tmp/verify-base HEAD
  # 在 /tmp/verify-base 里跑同一条测试命令
  git worktree remove --force /tmp/verify-base
  ```

  **不要用 `git stash`**：工作区里常挂着用户自己没提交的东西，stash
  会把它们一起收走，`stash pop` 冲突时还可能弄丢。本来就红的说出来
  就行，不要顺手修——那是另一件事，混进来 diff 就说不清了。
- 没有测试的项目：说明这个事实，然后把第 3 层做扎实。

## 3. 真跑一遍

测试全绿但功能不工作，真实存在——测试只测断言写到的地方。改了什么就
以什么方式碰一下：

- CLI：真执行一次改到的命令路径；
- 服务 / API：起 dev server，对改动的端点发一次真实请求；
- 页面 / UI：有浏览器工具就打开看一眼，截图确认；
- 库函数：写个几行的临时脚本调一下，用完删掉。
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint

mdr add riot-org/riot/verify@sha256:cd30231080248abf

The line at the top of this page pins the label git:20261014.9c3854a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

[![mdr](https://markdownregistry.com/badge/art_x3rv626grdjnbzfh.svg)](https://markdownregistry.com/a/art_x3rv626grdjnbzfh)

4 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 2 versions of this file, between Aug 17, 2026 and Oct 14, 2026, about one every 58 days.

version	committed	commit	size	audit
git:20261014.9c3854a latest	2026-10-14	9c3854a	3,141 B	A	view · diff
git:20260817.d4dfa41	2026-08-17	d4dfa41	2,786 B	A	view

Audit of the latest version

A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.

pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (3141 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag

Source

GitHub

riot-org/riot · 22 stars · license a license file GitHub does not identify · pushed 2026-11-05 · branch master

API

GET https://markdownregistry.com/api/v1/artifacts/art_x3rv626grdjnbzfh
GET https://markdownregistry.com/api/v1/resolve?ref=riot-org/riot/verify
GET https://markdownregistry.com/api/v1/blob/cd30231080248abf63501f5342124676a2b8344ad8995621a851d034dc93e43f

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from riot-org/riot

add-command SKILL.md skill

riot-org/riot · .riot/skills/add-command/SKILL.md · 给前端加一个 Tauri 命令时用。要改五处，漏了其中三处只表现为运行时「command not found」；权限文件还有个先后顺序的坑会让 build.rs 直接 panic。