vet-dependency SKILL.md skillA
vet-dependency from sergeyklay/.agents is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add sergeyklay/.agents/vet-dependency@v2.0Pins v2.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- sergeyklay/.agents
- Path
.agents/skills/vet-dependency/SKILL.md- Versions recorded
- 2
- Latest version
- v2.0, committed Sep 6, 2026
- First version recorded
- Sep 2, 2026
- Size
- 18,002 bytes
- Repository stars
- 6
- License
- Apache-2.0
Measure a candidate library's real maintenance state and its behavior against the protocol, schema, or API version the project has already pinned, before taking it as a dependency. Covers any ecosystem (Go, npm, PyPI, Cargo, Maven) and any forge (GitHub, GitLab, Gitea). Use when deciding whether to adopt, replace, or drop a library, when asked which of two or more packages that do the same job to use ('should we use X or Y'), when an architecture decision turns on whether a package is still…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Vetting a candidate dependency A package's landing page reports the wrong variables. Stars measure attention at some point in the past, release count measures how often a version was published, and the repository's last-push timestamp moves whenever anything touches it. None of the three answers the question that decides adoption: can this package reach the version this project has already committed to, and does it behave correctly when it gets there. The two facts that settle it are both invisible from the README. The first is the queue of pull requests nobody has merged, which measures whether the package can still move. The second is what the library does at runtime with the exact input class this project will feed it, which measures whether moving would help. The subject is a package that is not yet a dependency, characterized empirically before it becomes one rather than described from its documentation. This skill sits beneath `research-it`, which owns source priority, triangulation, and the discipline around absence claims. It owns only how a candidate's health and fitness are measured, and what verdict that measurement supports. …
Read the whole file at its exact version.
How to install
mdr add sergeyklay/.agents/vet-dependency@sha256:45b9113358b38a5aThe line at the top of this page pins the label v2.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_yxholwuvizpheni4)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Sep 2, 2026 and Sep 6, 2026, about one every 4 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v2.0 latest | 2026-09-06 | 371110d | 18,002 B | A | view · diff |
| v2.0 | 2026-09-02 | a4ce00e | 18,973 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (18002 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
sergeyklay/.agents · 6 stars · license Apache-2.0 · pushed 2026-11-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_yxholwuvizpheni4 GET https://markdownregistry.com/api/v1/resolve?ref=sergeyklay/.agents/vet-dependency GET https://markdownregistry.com/api/v1/blob/45b9113358b38a5ae18f4354649b7e832476f3af5e1fcc2a0bc4b2a1eb561560
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.