review SKILL.md skillA
review from riot-org/riot is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add riot-org/riot/review@git:20261014.9c3854aPins git:20261014.9c3854a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- riot-org/riot
- Path
crates/riot-kernel/builtin/skills/review/SKILL.md- Versions recorded
- 2
- Latest version
- git:20261014.9c3854a, committed Oct 14, 2026
- First version recorded
- Aug 17, 2026
- Size
- 3,373 bytes
- Repository stars
- 22
- License
- a license file GitHub does not identify
审查一批改动时用。缺陷优先：找静默的错答案、反了的失败方向、没测试守着的关键分支，按严重程度报告并说清审了多大范围。风格问题交给 lint，不在这里人肉报。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 审查改动 ## 先定范围 ```bash BASE=$(git rev-parse --abbrev-ref origin/HEAD 2>/dev/null) \ || BASE=$(git rev-parse --verify -q origin/main >/dev/null && echo origin/main || echo origin/master) git diff # 未提交的 git log --oneline "$BASE"..HEAD # 这条分支有哪些提交 git diff --stat "$BASE"...HEAD # 相对基线的全部改动 ``` `origin/HEAD` 在有些克隆里没设置，所以开头带了回退。 用户说「审一下」时通常指整条分支，不只是未提交的那点。 ## diff 只是入口，不是全貌 `[约束]` 逐个改动文件**读完整文件**，至少读到改动点所在的函数和它的 调用方。diff 里看起来对的行，放进调用方的语境里经常是错的——参数顺序、 单位、调用约定这类错误在 diff 视图里不可见。 范围太大读不过来时，说明白哪些只扫了 diff，不要假装全读了。 ## 该找什么（按回报排序） **1. 静默的错答案。** 不报错不崩、只是结果错的那类：错误被吞掉后返回 空集合、部分结果被当成全量、截断或超时提前收工没说出来、缓存该失效没 失效。判据：这条路上有没有可能「半份东西被当成全部」。 **2. 失败方向反了。** 解析失败、超时、认不出的输入，落在哪一侧？权限 判不准变成放行、校验失败当成通过、catch 里吞掉异常继续走——这类改动 单看每一行都合理，方向反了就是安全洞。 **3. 调用方没跟上。** 改了函数的签名、语义或返回值，所有调用点都重审 过吗？grep 一遍比信 diff 可靠：编译器只抓签名，抓不住语义（原来返回 空表示「没有」，现在表示「出错」——类型没变，含义全变）。 **4. 有实现没测试守着。** 对每个关键分支问：把这行删掉或改反，会有 测试红吗？答不上来就是发现。尤其是错误处理分支——它们几乎从不被手工 测到。 **5. 边界。** 空集合、0、负数、超长输入、重复调用、并发。别全列一遍， 只报这次改动**真的会碰到**的那几个。 **6. 不该入库的东西。** 密钥、调试输出、被注释掉的大段旧代码、意外 带上的生成物或临时文件。 ## 怎么报 按**严重程度**排，不按文件顺序。每条给： - 位置（`起始行:结束行:路径` 的引用格式）； - **会怎么表现**——具体症状，不是「可能有风险」。说不出症状的发现 多半不是发现； - 建议的改法，或「需要一个测试守着这里」。 …
Read the whole file at its exact version.
How to install
mdr add riot-org/riot/review@sha256:048e182f8369d884The line at the top of this page pins the label git:20261014.9c3854a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_ycet7ovcn767zb2j)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Aug 17, 2026 and Oct 14, 2026, about one every 58 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261014.9c3854a latest | 2026-10-14 | 9c3854a | 3,373 B | A | view · diff |
| git:20260817.d4dfa41 | 2026-08-17 | d4dfa41 | 3,214 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (3373 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
riot-org/riot · 22 stars · license a license file GitHub does not identify · pushed 2026-11-05 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_ycet7ovcn767zb2j GET https://markdownregistry.com/api/v1/resolve?ref=riot-org/riot/review GET https://markdownregistry.com/api/v1/blob/048e182f8369d884cbf30d96262a680a9f9993b2af3fdb1e1cf03ee57c14f709
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.