[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C5B5JQBGCXKBFPZ74YS7M4":3,"skill-same:01M6C5B5JQBGCXKBFPZ74YS7M4":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":6,"ownerDescription":41,"updatedAt":42,"install":43,"resources":56},"01M6C5B5JQBGCXKBFPZ74YS7M4","ship-artifact",null,"Package immutable release artifacts with provenance evidence.","Lyther\u002Fagent-surface","Lyther","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F29906124?v=4","01M6C587M9T34T0SAGJSRK043Y","Enderaoe","01M6C587R0TXH3MFR8SRFPV61G",65,"MIT","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fship-artifact\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29],"ship","ship artifact","artifact","release","artifacts","package","provenance","immutable","evidence","with","with provenance","2026-11-10 10:12:30",false,"---\nname: ship-artifact\ndescription: \"Package immutable release artifacts with provenance evidence.\"\n---\n\n## Objective\n\nTurn code into a portable artifact that records its exact repo, full Git commit, builder, and build time; ships the smallest practical runtime; and carries digests, checksums, signatures, SBOM, and provenance that a consumer can verify independently. Never promote an unsigned, unscanned, or unverifiable artifact. Claim \"same source, same artifact\" only after pinning inputs and comparing repeated builds.\n\n## Rules\n\n1. Abort when `git status` is not clean; a dirty build cannot be traced.\n2. Keep secrets out of the image (never `COPY .env .`); pass config at runtime.\n3. Pin base images, dependencies, lockfiles, and third-party CI actions by digest, checksum, or immutable version.\n4. Sign, verify, and deploy by digest, never by mutable tag.\n5. Every downstream step consumes the generated release or bundle manifest, never hand-copied values.\n\n## 1. Release Identity\n\n- The image digest or binary checksum is the identity; tags are pointers. Use specific names, not \"v1.0\".\n- Tag `sha-a1b2c3d` for operators and `v1.2.3` only for an intentional release.\n- Move `latest` only after verification and deployment succeed.\n- For non-OCI artifacts, publish `SHA256SUMS`, signatures, SBOM, and provenance together.\n- Publish one machine-readable release manifest binding Git SHA, artifact digest or checksum, bundle hash, version, SBOM path, and provenance path.\n\n## 2. Build\n\n- Build through one checked-in entrypoint (`scripts\u002Fbuild_artifact.sh` or `make artifact`) on `docker buildx` for OCI artifacts or an isolated builder otherwise, never an ad-hoc host with hidden state.\n- Target `linux\u002Famd64` and `linux\u002Farm64`.\n- Build multi-stage onto distroless or another minimal base pinned by digest; the final image holds no compiler, package manager, or source tree.\n- In every language, copy dependency manifests before application source so the cache survives rebuilds.\n- Prefer self-contained binaries for public CLI releases: Go with `CGO_ENABLED=0` and `-trimpath`, checked with `file`\u002F`ldd`; Rust with a `*-unknown-linux-musl` target when Linux portability matters and dependencies allow. Verify libc, TLS, CGO, and target-runtime behavior before claiming portability. `upx` is optional; it can trigger AV heuristics and hinders debugging.\n- Set `SOURCE_DATE_EPOCH` from the commit timestamp and strip non-deterministic metadata and absolute paths where the toolchain supports it. To claim reproducibility, build twice and compare digests or artifact hashes.\n\n## 3. Registry and Supply Chain\n\n- Auth with `docker login` locally; in CI use OIDC or short-lived credentials from a secret manager, never long-lived static tokens.\n- Set OCI labels `org.opencontainers.image.source` (repo URL), `.revision` (full Git SHA), `.version` (SemVer, if any), and `.created` (build timestamp).\n- Emit SBOM and provenance during the build when the toolchain supports it (`docker buildx --sbom=true --provenance=mode=max`); capture the pushed digest from build metadata and use it in every later step.\n- Scan the pushed image's SBOM before signing and fail above the policy threshold (the script uses `--fail-on high`); an unsigned image is not released.\n- Verify signatures and attestations against a pinned identity and OIDC issuer, or an equivalent admission policy, so the pipeline rejects unsigned or unverifiable artifacts.\n- Promote `latest` or production channels only after verification passes.\n\n## 4. Packaging\n\nGenerate customer-facing archives, installers, manifests, docs, and checksum files from one packaging step; never hand-assemble release zips on a builder host.\n\n- Desktop (Tauri\u002FElectron): `tauri build` \u002F `electron-builder` → `.msi`, `.dmg`, `.AppImage`; codesign, and notarize for Apple.\n- Mobile: Gradle \u002F Xcode → `.aab` \u002F `.ipa`; keep keystores in CI secrets and never commit `.jks` or `.p12`.\n- CLI: `cargo build --release --target x86_64-unknown-linux-musl` or `CGO_ENABLED=0 go build -trimpath -ldflags=\"-s -w\"`; check linkage with `file`\u002F`ldd`, smoke test on a clean host or container, and publish binaries, `SHA256SUMS`, signatures, SBOM, and install instructions together.\n- IoT\u002Fedge: cross-compile (`GOARCH=arm`, `armv7-unknown-linux-gnueabihf`) to a static binary or multi-arch image (`linux\u002Farm\u002Fv7`); check binary size, startup memory, and read-only filesystem limits.\n\n## 5. Verify\n\n1. Run it: `docker run --rm \u003Cimage@digest> --version`, or the healthcheck.\n2. Flag an image over 1 GB for review unless it carries an ML model.\n3. Check `docker history` for secrets, package-manager caches, and source dumps.\n4. Run `cosign verify` (or equivalent) with the expected identity and issuer.\n5. Confirm the provenance and SBOM exist and are inspectable.\n6. Confirm non-root execution and the expected entrypoint and linkage.\n7. Install or unpack the exact shipped bundle on a fresh host or container; verify required files exist and forbidden files are absent.\n8. Ship no source tree, test fixtures, internal prompts, debug endpoints, or private config unless explicitly intended.\n\n## Output\n\nThe build script (`scripts\u002Fbuild_artifact.sh`):\n\n```bash\n#!\u002Fusr\u002Fbin\u002Fenv bash\nset -euo pipefail\n\nIMAGE_NAME=\"${IMAGE_NAME:-ghcr.io\u002FOWNER\u002FIMAGE}\"\nREPO_URL=\"${REPO_URL:-https:\u002F\u002Fgithub.com\u002FOWNER\u002FREPO}\"\nRELEASE_MANIFEST=\"${RELEASE_MANIFEST:-release-manifest.json}\"\nCOMMIT_SHA=\"$(git rev-parse HEAD)\"\nCOMMIT_SHORT=\"$(git rev-parse --short HEAD)\"\nVERSION=\"${VERSION:-}\"\nBUNDLE_SHA256=\"${BUNDLE_SHA256:-}\"\nSOURCE_DATE_EPOCH=\"$(git log -1 --pretty=%ct)\"\nBUILD_METADATA=\"$(mktemp)\"\nBUILD_DATE=\"$(\n  SOURCE_DATE_EPOCH=\"$SOURCE_DATE_EPOCH\" python3 - \u003C\u003C'PY'\nfrom datetime import datetime, timezone\nimport os\nprint(datetime.fromtimestamp(int(os.environ[\"SOURCE_DATE_EPOCH\"]), timezone.utc).strftime(\"%Y-%m-%dT%H:%M:%SZ\"))\nPY\n)\"\n\ndocker buildx create --name artifact-builder --use >\u002Fdev\u002Fnull 2>&1 || docker buildx use artifact-builder\n\ndocker buildx build \\\n  --platform linux\u002Famd64,linux\u002Farm64 \\\n  --tag \"${IMAGE_NAME}:sha-${COMMIT_SHORT}\" \\\n  --label \"org.opencontainers.image.source=${REPO_URL}\" \\\n  --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \\\n  --label \"org.opencontainers.image.created=${BUILD_DATE}\" \\\n  --provenance=mode=max \\\n  --sbom=true \\\n  --metadata-file \"${BUILD_METADATA}\" \\\n  --push \\\n  .\n\nIMAGE_DIGEST=\"$(\n  python3 - \"${BUILD_METADATA}\" \u003C\u003C'PY'\nimport json, sys\nwith open(sys.argv[1], \"r\", encoding=\"utf-8\") as f:\n    data = json.load(f)\nprint(data[\"containerimage.digest\"])\nPY\n)\"\nIMAGE_REF=\"${IMAGE_NAME}@${IMAGE_DIGEST}\"\n\nsyft \"${IMAGE_REF}\" -o cyclonedx-json > sbom.cdx.json\ngrype sbom:sbom.cdx.json --fail-on high   # vulnerability gate before signing\n\ncosign sign --yes \"${IMAGE_REF}\"\ncosign attest --yes --predicate sbom.cdx.json --type cyclonedx \"${IMAGE_REF}\"\n\ncosign verify \\\n  --certificate-identity \"https:\u002F\u002Fgithub.com\u002FOWNER\u002FREPO\u002F.github\u002Fworkflows\u002Frelease.yml@refs\u002Fheads\u002Fmain\" \\\n  --certificate-oidc-issuer \"https:\u002F\u002Ftoken.actions.githubusercontent.com\" \\\n  \"${IMAGE_REF}\" >\u002Fdev\u002Fnull\n\nCOMMIT_SHA=\"${COMMIT_SHA}\" IMAGE_REF=\"${IMAGE_REF}\" IMAGE_DIGEST=\"${IMAGE_DIGEST}\" REPO_URL=\"${REPO_URL}\" BUILD_DATE=\"${BUILD_DATE}\" VERSION=\"${VERSION}\" BUNDLE_SHA256=\"${BUNDLE_SHA256}\" python3 - \u003C\u003C'PY' > \"${RELEASE_MANIFEST}\"\nimport json\nimport os\n\nprint(json.dumps({\n    \"repo\": os.environ[\"REPO_URL\"],\n    \"git_sha\": os.environ[\"COMMIT_SHA\"],\n    \"version\": os.environ[\"VERSION\"] or None,\n    \"image_ref\": os.environ[\"IMAGE_REF\"],\n    \"image_digest\": os.environ[\"IMAGE_DIGEST\"],\n    \"bundle_sha256\": os.environ[\"BUNDLE_SHA256\"] or None,\n    \"built_at\": os.environ[\"BUILD_DATE\"],\n    \"sbom\": \"sbom.cdx.json\",\n    \"provenance\": \"oci-attestation\",\n}, indent=2))\nPY\n\ndocker buildx imagetools inspect \"${IMAGE_REF}\" --format '{{json .Provenance}}' >\u002Fdev\u002Fnull\ndocker buildx imagetools inspect \"${IMAGE_REF}\" --format '{{json .SBOM}}' >\u002Fdev\u002Fnull\n\ndocker run --rm \"${IMAGE_REF}\" --version\n```\n","## Objective\n\nTurn code into a portable artifact that records its exact repo, full Git commit, builder, and build time; ships the smallest practical runtime; and carries digests, checksums, signatures, SBOM, and provenance that a consumer can verify independently. Never promote an unsigned, unscanned, or unverifiable artifact. Claim \"same source, same artifact\" only after pinning inputs and comparing repeated builds.\n\n## Rules\n\n1. Abort when `git status` is not clean; a dirty build cannot be traced.\n2. Keep secrets out of the image (never `COPY .env .`); pass config at runtime.\n3. Pin base images, dependencies, lockfiles, and third-party CI actions by digest, checksum, or immutable version.\n4. Sign, verify, and deploy by digest, never by mutable tag.\n5. Every downstream step consumes the generated release or bundle manifest, never hand-copied values.\n\n## 1. Release Identity\n\n- The image digest or binary checksum is the identity; tags are pointers. Use specific names, not \"v1.0\".\n- Tag `sha-a1b2c3d` for operators and `v1.2.3` only for an intentional release.\n- Move `latest` only after verification and deployment succeed.\n- For non-OCI artifacts, publish `SHA256SUMS`, signatures, SBOM, and provenance together.\n- Publish one machine-readable release manifest binding Git SHA, artifact digest or checksum, bundle hash, version, SBOM path, and provenance path.\n\n## 2. Build\n\n- Build through one checked-in entrypoint (`scripts\u002Fbuild_artifact.sh` or `make artifact`) on `docker buildx` for OCI artifacts or an isolated builder otherwise, never an ad-hoc host with hidden state.\n- Target `linux\u002Famd64` and `linux\u002Farm64`.\n- Build multi-stage onto distroless or another minimal base pinned by digest; the final image holds no compiler, package manager, or source tree.\n- In every language, copy dependency manifests before application source so the cache survives rebuilds.\n- Prefer self-contained binaries for public CLI releases: Go with `CGO_ENABLED=0` and `-trimpath`, checked with `file`\u002F`ldd`; Rust with a `*-unknown-linux-musl` target when Linux portability matters and dependencies allow. Verify libc, TLS, CGO, and target-runtime behavior before claiming portability. `upx` is optional; it can trigger AV heuristics and hinders debugging.\n- Set `SOURCE_DATE_EPOCH` from the commit timestamp and strip non-deterministic metadata and absolute paths where the toolchain supports it. To claim reproducibility, build twice and compare digests or artifact hashes.\n\n## 3. Registry and Supply Chain\n\n- Auth with `docker login` locally; in CI use OIDC or short-lived credentials from a secret manager, never long-lived static tokens.\n- Set OCI labels `org.opencontainers.image.source` (repo URL), `.revision` (full Git SHA), `.version` (SemVer, if any), and `.created` (build timestamp).\n- Emit SBOM and provenance during the build when the toolchain supports it (`docker buildx --sbom=true --provenance=mode=max`); capture the pushed digest from build metadata and use it in every later step.\n- Scan the pushed image's SBOM before signing and fail above the policy threshold (the script uses `--fail-on high`); an unsigned image is not released.\n- Verify signatures and attestations against a pinned identity and OIDC issuer, or an equivalent admission policy, so the pipeline rejects unsigned or unverifiable artifacts.\n- Promote `latest` or production channels only after verification passes.\n\n## 4. Packaging\n\nGenerate customer-facing archives, installers, manifests, docs, and checksum files from one packaging step; never hand-assemble release zips on a builder host.\n\n- Desktop (Tauri\u002FElectron): `tauri build` \u002F `electron-builder` → `.msi`, `.dmg`, `.AppImage`; codesign, and notarize for Apple.\n- Mobile: Gradle \u002F Xcode → `.aab` \u002F `.ipa`; keep keystores in CI secrets and never commit `.jks` or `.p12`.\n- CLI: `cargo build --release --target x86_64-unknown-linux-musl` or `CGO_ENABLED=0 go build -trimpath -ldflags=\"-s -w\"`; check linkage with `file`\u002F`ldd`, smoke test on a clean host or container, and publish binaries, `SHA256SUMS`, signatures, SBOM, and install instructions together.\n- IoT\u002Fedge: cross-compile (`GOARCH=arm`, `armv7-unknown-linux-gnueabihf`) to a static binary or multi-arch image (`linux\u002Farm\u002Fv7`); check binary size, startup memory, and read-only filesystem limits.\n\n## 5. Verify\n\n1. Run it: `docker run --rm \u003Cimage@digest> --version`, or the healthcheck.\n2. Flag an image over 1 GB for review unless it carries an ML model.\n3. Check `docker history` for secrets, package-manager caches, and source dumps.\n4. Run `cosign verify` (or equivalent) with the expected identity and issuer.\n5. Confirm the provenance and SBOM exist and are inspectable.\n6. Confirm non-root execution and the expected entrypoint and linkage.\n7. Install or unpack the exact shipped bundle on a fresh host or container; verify required files exist and forbidden files are absent.\n8. Ship no source tree, test fixtures, internal prompts, debug endpoints, or private config unless explicitly intended.\n\n## Output\n\nThe build script (`scripts\u002Fbuild_artifact.sh`):\n\n```bash\n#!\u002Fusr\u002Fbin\u002Fenv bash\nset -euo pipefail\n\nIMAGE_NAME=\"${IMAGE_NAME:-ghcr.io\u002FOWNER\u002FIMAGE}\"\nREPO_URL=\"${REPO_URL:-https:\u002F\u002Fgithub.com\u002FOWNER\u002FREPO}\"\nRELEASE_MANIFEST=\"${RELEASE_MANIFEST:-release-manifest.json}\"\nCOMMIT_SHA=\"$(git rev-parse HEAD)\"\nCOMMIT_SHORT=\"$(git rev-parse --short HEAD)\"\nVERSION=\"${VERSION:-}\"\nBUNDLE_SHA256=\"${BUNDLE_SHA256:-}\"\nSOURCE_DATE_EPOCH=\"$(git log -1 --pretty=%ct)\"\nBUILD_METADATA=\"$(mktemp)\"\nBUILD_DATE=\"$(\n  SOURCE_DATE_EPOCH=\"$SOURCE_DATE_EPOCH\" python3 - \u003C\u003C'PY'\nfrom datetime import datetime, timezone\nimport os\nprint(datetime.fromtimestamp(int(os.environ[\"SOURCE_DATE_EPOCH\"]), timezone.utc).strftime(\"%Y-%m-%dT%H:%M:%SZ\"))\nPY\n)\"\n\ndocker buildx create --name artifact-builder --use >\u002Fdev\u002Fnull 2>&1 || docker buildx use artifact-builder\n\ndocker buildx build \\\n  --platform linux\u002Famd64,linux\u002Farm64 \\\n  --tag \"${IMAGE_NAME}:sha-${COMMIT_SHORT}\" \\\n  --label \"org.opencontainers.image.source=${REPO_URL}\" \\\n  --label \"org.opencontainers.image.revision=${COMMIT_SHA}\" \\\n  --label \"org.opencontainers.image.created=${BUILD_DATE}\" \\\n  --provenance=mode=max \\\n  --sbom=true \\\n  --metadata-file \"${BUILD_METADATA}\" \\\n  --push \\\n  .\n\nIMAGE_DIGEST=\"$(\n  python3 - \"${BUILD_METADATA}\" \u003C\u003C'PY'\nimport json, sys\nwith open(sys.argv[1], \"r\", encoding=\"utf-8\") as f:\n    data = json.load(f)\nprint(data[\"containerimage.digest\"])\nPY\n)\"\nIMAGE_REF=\"${IMAGE_NAME}@${IMAGE_DIGEST}\"\n\nsyft \"${IMAGE_REF}\" -o cyclonedx-json > sbom.cdx.json\ngrype sbom:sbom.cdx.json --fail-on high   # vulnerability gate before signing\n\ncosign sign --yes \"${IMAGE_REF}\"\ncosign attest --yes --predicate sbom.cdx.json --type cyclonedx \"${IMAGE_REF}\"\n\ncosign verify \\\n  --certificate-identity \"https:\u002F\u002Fgithub.com\u002FOWNER\u002FREPO\u002F.github\u002Fworkflows\u002Frelease.yml@refs\u002Fheads\u002Fmain\" \\\n  --certificate-oidc-issuer \"https:\u002F\u002Ftoken.actions.githubusercontent.com\" \\\n  \"${IMAGE_REF}\" >\u002Fdev\u002Fnull\n\nCOMMIT_SHA=\"${COMMIT_SHA}\" IMAGE_REF=\"${IMAGE_REF}\" IMAGE_DIGEST=\"${IMAGE_DIGEST}\" REPO_URL=\"${REPO_URL}\" BUILD_DATE=\"${BUILD_DATE}\" VERSION=\"${VERSION}\" BUNDLE_SHA256=\"${BUNDLE_SHA256}\" python3 - \u003C\u003C'PY' > \"${RELEASE_MANIFEST}\"\nimport json\nimport os\n\nprint(json.dumps({\n    \"repo\": os.environ[\"REPO_URL\"],\n    \"git_sha\": os.environ[\"COMMIT_SHA\"],\n    \"version\": os.environ[\"VERSION\"] or None,\n    \"image_ref\": os.environ[\"IMAGE_REF\"],\n    \"image_digest\": os.environ[\"IMAGE_DIGEST\"],\n    \"bundle_sha256\": os.environ[\"BUNDLE_SHA256\"] or None,\n    \"built_at\": os.environ[\"BUILD_DATE\"],\n    \"sbom\": \"sbom.cdx.json\",\n    \"provenance\": \"oci-attestation\",\n}, indent=2))\nPY\n\ndocker buildx imagetools inspect \"${IMAGE_REF}\" --format '{{json .Provenance}}' >\u002Fdev\u002Fnull\ndocker buildx imagetools inspect \"${IMAGE_REF}\" --format '{{json .SBOM}}' >\u002Fdev\u002Fnull\n\ndocker run --rm \"${IMAGE_REF}\" --version\n```\n",{"name":5,"description":7},"main","bb71e1631303bd27cb8ac18dc04830c97db8ac4d","skills\u002Fship-artifact",0,"https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface","https:\u002F\u002Fgithub.com\u002FLyther","Why so serious?","2026-11-13 17:36:21",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add Lyther\u002Fagent-surface --skill ship-artifact",{"tool":49,"command":50},"bunx","bunx skills add Lyther\u002Fagent-surface --skill ship-artifact",{"tool":52,"command":53},"pnpm","pnpm dlx skills add Lyther\u002Fagent-surface --skill ship-artifact","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fship-artifact\u002FSKILL.md",true,[],[58,84,97,110,128,139],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":69,"publishedAt":30},"01M6C5CQAHK34J7RNHEJE1G366","workflow-runtime","Prove skill or workflow discovery, full-autonomy tool execution, and task-shaped materialization before assigning a CLI, extension, provider, or model to a workflow role.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-runtime\u002FSKILL.md",[64],{"categoryNo":65,"categoryName":66,"taxonomyType":67,"taxonomyTypeDesc":68},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[70,71,72,73,74,75,76,77,78,79,80,81,82,83],"workflow","workflow runtime","runtime","execution","cli","discovery","tool","model","autonomy","provider","task","full","extension","role",{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":30},"01M6C5CNCTDS39453E66MQYTTQ","workflow-reviewer","Review batched implementation output against the BOSS spec and evidence.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-reviewer\u002FSKILL.md",[],[91,92,70,93,94,27,95,96],"workflow reviewer","reviewer","spec","review","implementation","output",{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":104,"publishedAt":30},"01M6C5CKVKQF6NE9263HGRB2K3","workflow-rescue","Resolve repeated workflow failures with a single decisive action.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-rescue\u002FSKILL.md",[103],{"categoryNo":65,"categoryName":66,"taxonomyType":67,"taxonomyTypeDesc":68},[70,105,106,107,108,28,109],"workflow rescue","rescue","single","decisive action","action",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":30},"01M6C5CHCW474Y5F49WME2G12H","workflow-orchestrator","Run risk-adaptive development, review, multi-agent, and release workflows with runtime preflight, bounded retries, liveness checks, isolated writers, and evidence-backed handoffs.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-orchestrator\u002FSKILL.md",[116],{"categoryNo":65,"categoryName":66,"taxonomyType":67,"taxonomyTypeDesc":68},[118,119,70,28,120,94,121,122,22,123,124,125,27,72,126,127],"orchestrator","workflow orchestrator","development","workflows","run","risk","preflight","multi-agent","multi","retries",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":30},"01M6C5CFCYEW1J4ETBNDD4EQPK","workflow-judger","Arbitrate repeated task failures and decide merge, rework, or escalation.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-judger\u002FSKILL.md",[],[135,70,136,137,138,80],"workflow judger","merge","escalation","decide",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":30},"01M6C5CDADZX0YM26H2QWWDJMF","workflow-doctor","Validate active workflow state before any role acts on it.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-doctor\u002FSKILL.md",[145],{"categoryNo":65,"categoryName":66,"taxonomyType":67,"taxonomyTypeDesc":68},[70,147,148,149,150,151,152,83],"workflow doctor","doctor","validate","state","active","it"]