beyond-the-fix SKILL.md skillA

beyond-the-fix from annatchijova/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned
mdr add annatchijova/skills/beyond-the-fix@git:20260822.9eda33b

Pins git:20260822.9eda33b in mdr.lock. Pin the fingerprint instead.

Audit grade
A, 17 of 17 checks passed
Kind
SKILL.md skill
Repository
annatchijova/skills
Path
beyond-the-fix/SKILL.md
Versions recorded
1
Latest version
git:20260822.9eda33b, committed Aug 22, 2026
Size
13,064 bytes
Repository stars
9
License
a license file GitHub does not identify

Audit the bug fixes themselves — a patch proves that someone knew something was wrong there, never that it is now right. Hunt the eight ways a fix falls short: it covers the demonstrated input instead of the property, one path instead of every path, the wrong layer, the symptom instead of the cause, nothing enforcing it against the next caller, a new bug introduced by the rushed diff, siblings left unpatched, or a fix that has since decayed. Use whenever a fix, patch, advisory, CVE, changelog…

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# Beyond the Fix

A patch is the highest-signal artifact in any repository. Someone already did
the expensive part: they found the class, located the file, and wrote down what
they believed was wrong. What they did not do — because nobody does — is keep
looking after the tests went green.

The thesis, in one line:

> **That someone fixed it means they fixed that, and nothing else.**

A fix is evidence about the *past*: something was wrong here, and a human
confirmed it. It is not evidence about the present. Those are different claims,
and the entire discipline of this skill lives in the gap between them.

Three biases produce that gap, and all three are structural rather than
personal:

1. **Attention collapses at green.** The search terminates the moment the
   reporter's PoC stops reproducing. That oracle — *my one input no longer
   works* — is the weakest oracle in existence: it tests an input, not the
   property (`falsifiable-testing`).
2. **The frame came from the reporter.** The fixer inherited the demonstrated
   path and fixed the demonstrated path. Whatever the reporter did not think of,
   the fix does not cover.
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint
mdr add annatchijova/skills/beyond-the-fix@sha256:610618917391468b

The line at the top of this page pins the label git:20260822.9eda33b, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

mdr badge

[![mdr](https://markdownregistry.com/badge/art_y3iozl4weocwdvt3.svg)](https://markdownregistry.com/a/art_y3iozl4weocwdvt3)

5 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 1 version of this file, committed on Aug 22, 2026.

versioncommittedcommitsizeaudit
git:20260822.9eda33b latest2026-08-22 9eda33b 13,064 BA view

Audit of the latest version

A  17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.
  • pass: Frontmatter block present
  • pass: Frontmatter declares a name
  • pass: Frontmatter declares a description
  • pass: Size between 200 bytes and 200 KB (13064 bytes)
  • pass: No zero-width or bidi control characters
  • pass: No instruction hidden inside an HTML comment
  • pass: No link to an exfiltration or paste host
  • pass: No credential-shaped string
  • pass: No instruction to send local credentials anywhere
  • pass: No text hidden with inline styles
  • pass: No prompt-injection phrasing
  • pass: No curl or wget piped into a shell
  • pass: No recursive delete of root, home or parent
  • pass: No instruction to read or print local credentials
  • pass: No base64 blob over 200 characters
  • pass: No link to a raw IP address
  • pass: No script tag

Source

GitHub

annatchijova/skills · 9 stars · license a license file GitHub does not identify · pushed 2026-11-02 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_y3iozl4weocwdvt3
GET https://markdownregistry.com/api/v1/resolve?ref=annatchijova/skills/beyond-the-fix
GET https://markdownregistry.com/api/v1/blob/610618917391468b369def4450a82183174da5e9f487bbc1dcb0e336b0409268

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from annatchijova/skills

abductive-engineering SKILL.md skill
annatchijova/skills · abductive-engineering/SKILL.md · Software engineering best practices grounded in C.S. Peirce's abductive reasoning and his triadic framework…
git:20260708.f31c428 · audit A · 9 stars
acquisition-order-of-volatility SKILL.md skill
annatchijova/skills · acquisition-order-of-volatility/SKILL.md · Collect digital evidence in order of volatility, or destroy the thing you came for — memory, network state, and running…
git:20260825.8500180 · audit A · 9 stars
agent-trust-boundaries SKILL.md skill
annatchijova/skills · agent-trust-boundaries/SKILL.md · Design LLM and agentic systems so that retrieved content is data and never instruction — instruction authority comes…
git:20260815.2390440 · audit A · 9 stars
alert-triage-economics SKILL.md skill
annatchijova/skills · alert-triage-economics/SKILL.md · Triage a security alert queue by expected loss, not by the severity label the tool stamped — because analyst attention…
git:20260825.8500180 · audit A · 9 stars
assume-breach-modeling SKILL.md skill
annatchijova/skills · assume-breach-modeling/SKILL.md · Start from "this step already succeeded" and map what the attacker reaches next — the identity held at that position…
git:20260822.f25b32b · audit A · 9 stars
atomic-state-mutation SKILL.md skill
annatchijova/skills · atomic-state-mutation/SKILL.md · Make a logical operation that spans several writes to persistent state land all-or-nothing, isolated from concurrent…
git:20260708.f31c428 · audit A · 9 stars
attack-surface-triage SKILL.md skill
annatchijova/skills · attack-surface-triage/SKILL.md · Enumerate the attack surface of an AUTHORIZED target and rank it into a reproducible, falsifiable candidate queue —…
git:20260815.2390440 · audit A · 9 stars
audit-before-patch SKILL.md skill
annatchijova/skills · audit-before-patch/SKILL.md · Validate any audit finding, bug report, or proposed fix against the actual current file content before changing a…
git:20260708.f31c428 · audit A · 9 stars
authorization-surface-mapping SKILL.md skill
annatchijova/skills · authorization-surface-mapping/SKILL.md · Build the actor × resource × action matrix a system implicitly claims to enforce, then test the cells it never wrote a…
git:20260822.f25b32b · audit A · 9 stars
beyond-the-sink SKILL.md skill
annatchijova/skills · beyond-the-sink/SKILL.md · Look past the obvious layer of an investigation — past sink-grep keyword lists, past the exhausted question family…
git:20260821.38a2b1d · audit A · 9 stars
claim-provenance-discipline SKILL.md skill
annatchijova/skills · claim-provenance-discipline/SKILL.md · Tracking and preserving the origin of every assertion as it travels through drafts, handoffs, summaries, and documents…
git:20260710.eb435f4 · audit A · 9 stars
client-side-trust-boundary SKILL.md skill
annatchijova/skills · client-side-trust-boundary/SKILL.md · Treat any code or data that runs on a device the user controls as code and data the adversary controls — the mobile…
git:20260825.0cef3f6 · audit A · 9 stars

Every file in annatchijova/skills

Browse by kind, by grade A, or by owner.