env-doctor SKILL.md skillA
env-doctor from cat-xierluo/legal-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add cat-xierluo/legal-skills/env-doctor@v0.4.0Pins v0.4.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- cat-xierluo/legal-skills
- Path
skills/env-doctor/SKILL.md- Versions recorded
- 3
- Latest version
- v0.4.0, committed Oct 17, 2026
- First version recorded
- Sep 29, 2026
- Size
- 5,373 bytes
- Repository stars
- 775
- License
- none declared
本机开发环境与全局包的体检、账本与安装纪律，覆盖所有包管理器（npm/npx、nvm、pip/pipx、uv、brew、bun）与运行时环境面（~/.local/bin 垫片、PATH、python 解释器版图、LaunchAgents、cron、shell rc 漂移对照）。当用户问「node/python 为什么是这个版本」「npm/pip 全局包装到哪了」「环境怎么又乱了」「PATH/rc 被谁改了」「多了个 LaunchAgent」，或任何 agent 在执行 npm i -g / uv tool install / pipx install / brew install 等全局安装、修改 shell rc 文件、注册 LaunchAgent/cron、触碰 ~/.local/bin 符号链接、或在厂商应用（Hermes/Deck/Wukong 等）更新后复核环境之前，必须先读本 skill 并遵守其纪律。不要用于：单个项目内的 node_modules / venv 依赖管理、CI 环境、Linux 服务器初始化。仅 macOS。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# env-doctor · 环境与全局包体检、账本与安装纪律
本机装了大量自带运行时的 agent 应用（Hermes、Deck、Wukong、Eigent……），加上 nvm /
uv / pipx / brew / bun 多套包管理器并存，摩擦全部出现在接缝处：谁排 PATH 前面、
node/python 归谁、全局包装进哪个 prefix、哪个链接死了。本 skill 用「确定性体检 +
账本 + 安装纪律」把地质层变成可查账的：脏了立刻可见，每次变更有据可查。
（心智模型同 `brew doctor` / `npm doctor`：环境医生。）
## 硬纪律（所有 agent 必须遵守，先于任何环境写操作）
1. **全局安装只走白名单落点，装完必须记账**（`record` 子命令，一条命令的事）：
- Node 包：`npm i -g`，且 npm 必须是 **nvm 当前默认版本** 的（用 `npm prefix -g`
核对，不是则先停下报告）；
- Python CLI：`uv tool install`（或 `pipx install`），**不要** `pip install --user`
手装 CLI；
- 系统依赖：`brew install`；
- bun 全局尽量少用，装了必记账。
2. **三类操作默认禁止**，除非用户当次明示授权且完成后立即记账：修改 shell rc 文件
（`~/.zshenv` / `~/.zprofile` / `~/.zshrc` / `~/.profile`）；注册 LaunchAgent 或
cron；在 `~/.local/bin` 新增或改指 node/npm/npx/python 等运行时垫片。
3. **`~/.local/bin` 是全机唯一垫片层**：这里的 node/npm/npx 链接决定所有 shell（包括
launchd 拉起的干净 shell）的默认运行时。只允许跟随 nvm default 重指，且必须记账。
4. **厂商应用升级后先体检**：跑一次 `env-doctor.sh`，若报 🚨（垫片漂移，多为 Hermes
等把 node 链接抢回自家），**只报告用户，不擅自改回**——那可能是该应用有意的依赖。
5. **判断运行时/包的归属看链接与 prefix，不看表面**：`which -a node` + `readlink` 读
出真实目标，`npm prefix -g` / `pip -V` 看真实落点；版本号一致不代表是同一个
node（本机曾有 4 个并存、pip 有 user/brew/uv 多套）。
## 体检（确定性检测）
```bash
…Read the whole file at its exact version.
How to install
mdr add cat-xierluo/legal-skills/env-doctor@sha256:e0ed1975f5a5130dThe line at the top of this page pins the label v0.4.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_zsj647fyr4uridya)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Sep 29, 2026 and Oct 17, 2026, about one every 9 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v0.4.0 latest | 2026-10-17 | 591ceb0 | 5,373 B | A | view · diff |
| v0.3.0 | 2026-09-29 | 4e0558e | 5,252 B | A | view · diff |
| v0.2.0 | 2026-09-29 | d2bfdfa | 4,661 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5373 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
cat-xierluo/legal-skills · 775 stars · license none declared · pushed 2026-11-01 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_zsj647fyr4uridya GET https://markdownregistry.com/api/v1/resolve?ref=cat-xierluo/legal-skills/env-doctor GET https://markdownregistry.com/api/v1/blob/e0ed1975f5a5130d684ef6c74a0b0c8dc81d3876ff5fa8f91e891dba5b7fa0b9
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from cat-xierluo/legal-skills
Every file in cat-xierluo/legal-skills