How to pin an agent skill to an exact version

Description and use

Pinning agent skills to an exact version using a content hash and mdr.lock ensures deterministic execution and enables change tracking.

Problem

Agent skills can change frequently, causing runtime inconsistencies when an agent loads a skill by path and receives the latest file contents.

Outcome

By pinning skills to a content hash and using a lockfile, agents run deterministic skill versions, detect upstream changes, and can safely update after reviewing diffs.

Workflow

• Install the mdr CLI from https://markdownregistry.com/cli
• Run mdr add owner/repo/skill@version to install a specific version and generate a lockfile
• Use mdr outdated to list pinned skills whose SKILL.md changed
• Run mdr diff owner/repo/skill to view changes between the pinned and latest versions
• If updates are acceptable, run mdr update owner/repo/skill to overwrite with the new version
• If local edits exist, back up the skill directory before updating and manually merge changes

Evidence

Pin a skill by a fingerprint of its exact contents, not just by where it lives.

Source

In the registry's own crawl, of 47,724 agent markdown files watched for at least 14 days, at least 19.9% changed on GitHub within 14 days of being collected

Source

mdr add owner/repo/skill@version installs that version's files from their source commit on GitHub and checks every file against its published fingerprint before writing anything

Source

mdr outdated anthropics/skills/skill-creator git:20260225.3d59511 to git:20260306.b0cbd3d audit A (2026-03-06) mdr diff anthropics/skills/skill-creator $? 2

Source