[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70DETF97ZCEXV3ZT86SYTY2":3,"skill-same:01M70DETF97ZCEXV3ZT86SYTY2":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M70DETF97ZCEXV3ZT86SYTY2","skill-lifecycle-manager",null,"Upgrade or synchronize Agent Skills, or determine a Skill's source and ownership across runtimes and roots. Use only for those lifecycle decisions. Do not use for installation, creation or editing, validation, inventory, usage statistics, general audits, cleanup, packaging, publishing, or ordinary file and package work.","EthanYoQ\u002FSkill-hub","EthanYoQ","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F257484394?v=4","01M70C9QKWR1YS0S7V26DNB18H","Ethan","01M70C9QMER047R5ANZZA6KC2P",11,"MIT","https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Farchives\u002Fuser-installed-skills\u002Fskill-lifecycle-manager\u002F0143a0d1372a542a\u002Fskill-lifecycle-manager\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"skill lifecycle manager","lifecycle","manager","publishing","general","editing","for","runtimes","usage","do","source","work","across","statistics","upgrade","cleanup","only","inventory","packaging","creation","2026-11-10 10:12:30",false,"---\nname: skill-lifecycle-manager\ndescription: Upgrade or synchronize Agent Skills, or determine a Skill's source and ownership across runtimes and roots. Use only for those lifecycle decisions. Do not use for installation, creation or editing, validation, inventory, usage statistics, general audits, cleanup, packaging, publishing, or ordinary file and package work.\n---\n\n# Skill Lifecycle Manager\n\nOrchestrate skill work as one evidence-backed lifecycle. Keep source,\ninstallation, and ownership separate so an update to one copy does not silently\noverwrite another.\n\n## Invocation Boundary\n\nUse this skill only to upgrade Skills, synchronize Skill copies, determine a\nSkill's source, or determine who owns and may update a Skill. For every other\nSkill-related request, continue without this skill and use the narrower\napplicable workflow.\n\n## Core Contract\n\nMaintain three boundaries throughout the task:\n\n- **Source**: where the skill came from, such as GitHub, skills.sh, a Skill Hub\n  checkout, or a local repository.\n- **Install**: where a runtime loads the active skill, such as a global user\n  root or project root.\n- **Ownership**: whether the path is user-maintained, project-maintained, or\n  system\u002Fplugin-managed.\n- **Runtime**: which loader owns the active copy, such as Codex, Claude Code,\n  an Agent Skills-compatible host, or more than one runtime.\n\nDo not treat a Skill Hub checkout, `_repos` source, plugin cache, and global\ninstall as interchangeable even when their skill names match.\n\nWhen evidence is incomplete, report known facts, candidate hypotheses,\nverification paths, and temporary mitigation. Do not present an unverified\nhypothesis as a cause or completed fix.\n\n## Start With Lifecycle Triage\n\nCreate a compact internal task card before acting:\n\n- **Intent**: discover, recommend, install, update, sync, merge, audit, cleanup,\n  package, publish, validate, or create\u002Fedit.\n- **Target**: skill name, source URL, repository path, installed path, or topic.\n- **Scope**: project, global\u002Fuser, source repository, managed root, or unknown.\n- **Runtime**: Codex, Claude Code, multiple runtimes, or unknown. Do not assume\n  the runtime executing this skill is the runtime whose skills are being\n  managed.\n- **Destructive risk**: none, overwrite, move, delete, cleanup, or ownership\n  change.\n- **Evidence needed**: source, version, usage, quality, or scope proof.\n- **Companion skill**: `find-skills`, `skill-installer`, `skill-creator`, or no\n  companion.\n\nProceed without asking when target, scope, and ownership are clear. Ask a short\nquestion only when a reasonable assumption could modify the wrong skill or\ncross an ownership boundary.\n\n## Route To The Relevant Reference\n\nRead the complete relevant reference before performing that operation:\n\n| Operation | Required reference |\n| --- | --- |\n| Skill Hub pull, push, new-skill sync, junction, or index rebuild | [references\u002Fskill-hub-operations.md](references\u002Fskill-hub-operations.md) |\n| Upstream comparison, `skill-upgrade`, `check_upstreams.ps1`, mirror, or local fast-forward | [references\u002Fupstream-audit.md](references\u002Fupstream-audit.md) |\n| Runtime roots, Claude Code skills\u002Fplugins, scope precedence, cache ownership, or reload behavior | [references\u002Fruntime-adapters.md](references\u002Fruntime-adapters.md) |\n| Discovery, recommendation, install scope, quality audit, usage cleanup, package, publish, or report format | [references\u002Fgovernance-and-reporting.md](references\u002Fgovernance-and-reporting.md) |\n\nRead more than one reference when the task crosses those boundaries. Do not\nload unrelated operational detail for a simple task.\n\n## Discover Stores And Ownership\n\nDiscover actual roots before editing. Common roots include:\n\n- User\u002Fglobal roots: current Codex user skills belong in `~\u002F.agents\u002Fskills`.\n  `$CODEX_HOME\u002Fskills` (normally `~\u002F.codex\u002Fskills`) is a deprecated\n  compatibility location for older Codex installs; migrate user-owned skills\n  from it instead of choosing it for new installs. Claude Code personal skills\n  live under `${CLAUDE_CONFIG_DIR:-~\u002F.claude}\u002Fskills`.\n- Project roots: current Codex project skills use `.agents\u002Fskills` from the\n  working directory through the repository root. Treat project `.codex\u002Fskills`\n  as compatibility state. Claude Code uses `.claude\u002Fskills` and can also\n  discover nested package roots in a monorepo.\n- Source checkouts: `_repos`, Skill Hub clones, submodules, or manual clones.\n- Managed roots: `.system` skills and plugin caches. Claude Code marketplace\n  plugins are managed through `claude plugin`, not by editing\n  `~\u002F.claude\u002Fplugins\u002Fcache`.\n- Evidence indexes: a repository `_meta\u002Fskill-upstreams.json` or a local\n  source index such as `~\u002F.skill-lifecycle\u002Fskill-upstreams.json`; legacy\n  `~\u002F.agents\u002Fskill-upstreams.json` remains supported. `skills-lock.json` is an\n  inventory, not proof of upstream identity.\n\n`CLAUDE_CONFIG_DIR` relocates Claude Code's configuration and personal skills;\nit does not relocate the runtime-neutral source index. Keep the default index\nunder the operating-system user home unless `-IndexPath` is explicit. Likewise,\n`~\u002F.agents\u002Fskills` is a shared Agent Skills root even though current Codex loads\nit at user scope. Record Codex ownership only when loader or configuration\nevidence establishes it; the path alone does not prove exclusive ownership.\n\nTreat managed roots as read-only unless the user explicitly authorizes an\noverride. Treat source checkouts as source evidence, not automatically as the\nactive install target.\n\nKeep an internal inventory:\n\n| Skill | Runtime\u002Fscope | Source | Active install | Owner | Intended action |\n| --- | --- | --- | --- | --- | --- |\n\n## Lifecycle Safety Sequence\n\nUse this sequence for any operation that can change state:\n\n1. Inventory source, install, ownership, branch\u002Fref, and dirty state.\n2. Verify source and scope with evidence appropriate to the operation.\n3. Compare behavior and files before deciding replace versus merge.\n4. Run a dry run when supported.\n5. Resolve target paths and prove they are strictly below the intended root.\n6. Create a timestamped backup before overwrite, mirror, move, or deletion.\n7. Apply only the requested, ownership-compatible change.\n8. Validate source and installed copies separately when both exist.\n9. Report source, target, backup, changed files, validation, and unverified\n   items.\n\nA path equal to the allowed root is not a valid child target. A path that only\nshares the root's text prefix is also not inside that root.\n\n## Create Or Edit Skills\n\nUse `skill-creator` for SKILL.md design, progressive disclosure, scripts,\nreferences, and evals. This manager owns placement and lifecycle decisions:\n\n- Put broadly reusable, trusted workflows in a global\u002Fuser root and a shared\n  Skill Hub path when repository publication is intended.\n- Put project-specific conventions, private workflows, or experiments in a\n  project root.\n- Avoid same-name duplicates across active roots unless the user explicitly\n  wants scope-specific variants.\n- Validate the source copy before installing it, then compare source and\n  installed hashes.\n- For Claude Code, use personal or project `.claude\u002Fskills` for standalone\n  skills and a plugin only when namespaced distribution, versioned updates, or\n  bundled agents\u002Fhooks\u002FMCP are actually needed.\n\n## Discovery And Installation\n\nUse `find-skills` or the ecosystem's discovery command instead of inventing a\nnew search process. Use `skill-installer` when the requested installation flow\nmatches it.\n\nBefore recommending or installing:\n\n- Check active roots for existing or competing skills.\n- Resolve the exact repository, path, branch\u002Fref, and skill directory.\n- Read the candidate SKILL.md and inspect scripts or dependencies.\n- Record observed installs, stars, license, update activity, and source\n  reputation; mark unavailable evidence as unavailable.\n- Choose the smallest scope that supports the repeated workflow.\n\nRead [references\u002Fgovernance-and-reporting.md](references\u002Fgovernance-and-reporting.md)\nfor detailed evidence thresholds, quality checks, and report formats.\n\n## Upgrade And Merge\n\nNever upgrade by name alone. Separate source updates from active-install\nupdates:\n\n1. Resolve the exact installed path in a source index. If no verified mapping\n   exists, run the source-discovery workflow and persist the result before\n   deciding whether an upgrade exists.\n2. Verify upstream repository, skill subdirectory, branch\u002Fref, and immutable\n   comparison commit. A GitHub URL mentioned as a dependency or example is\n   only a candidate, not source proof.\n3. Compare SKILL.md, references, scripts, assets, and evals.\n4. Back up the target.\n5. Mirror only when policy and evidence permit exact replacement.\n6. Merge when local and upstream behavior both matter.\n7. Validate and report the final source\u002Finstall relationship.\n\nTreat source mapping as reusable lifecycle state, not one-off research. Key\nlocal mappings by canonical installed path so two same-name skills cannot\ninherit each other's upstream. On each later audit, refresh the verified ref,\nrecord the observed commit, and compare the complete skill directory. Read\n[references\u002Fupstream-audit.md](references\u002Fupstream-audit.md) for the bootstrap,\nverification, index, and repeat-audit workflow.\n\nFor Claude Code marketplace plugins, the plugin manager is the lifecycle\nauthority. Inventory with `claude plugin list --json`, compare the declared\nmarketplace\u002Fversion\u002Fsource, preserve the installed scope in\n`claude plugin update \u003Cplugin> --scope \u003Cscope>`, and follow the CLI's restart\ninstruction; never mirror files into the versioned plugin cache. Read\n[references\u002Fruntime-adapters.md](references\u002Fruntime-adapters.md) before acting.\n\nDo not invent lifecycle metadata or policy. `source`, `repository`, `version`,\nor similar frontmatter fields are useful only when actually present and remain\ncandidate evidence until verified. Do not assume semantic versions, automatic\npolling, retry-count downgrades, a `stale` classification, or time-based\nthresholds unless the source index or user policy defines them.\n\nWhen both versions changed, summarize behavior-level differences before\nmerging:\n\n- Triggering and description\n- Tools and dependencies\n- Safety and destructive operations\n- Output contract\n- Scripts, references, assets, and evals\n\nRead [references\u002Fupstream-audit.md](references\u002Fupstream-audit.md) before using\nthe bundled audit helper or applying a mirror.\n\n## Quality, Cleanup, And Publishing\n\nFor quality audits, check frontmatter, trigger specificity, progressive\ndisclosure, referenced resources, script safety, dependencies, secrets,\nabsolute-path leakage, and objective eval coverage.\n\nFor usage cleanup, do not use filesystem `LastAccessTime` as proof. Prefer\nexplicit invocation evidence, session\u002Ftool logs, loadability metadata, then\nfilesystem presence. Quarantine uncertain candidates instead of deleting them.\n\nFor publishing, complete and save the quality and secret\u002Fprivacy audit before\ncreating or copying the package. Scan file contents as well as names, including\nquoted JSON\u002FYAML credential keys, environment assignments, tokens, private\nkeys, personal paths, and identifiers. Treat an unreadable file or an\nunclassified finding as a failed gate; do not package first and repair the\naudit afterward. Then keep only allowlisted runtime-relevant skill files,\nremove generated outputs and private data, record provenance, update indexes,\nand deliberately synchronize source and installed copies.\n\nRead [references\u002Fgovernance-and-reporting.md](references\u002Fgovernance-and-reporting.md)\nfor the full gates, evidence labels, and output templates.\n\n## Validation\n\nUse the strongest relevant validation:\n\n- Parse frontmatter and required fields.\n- Run `skill-creator` validation.\n- Run bundled script self-tests or safe dry runs.\n- Parse JSON indexes and compare indexed counts with actual SKILL.md files.\n- Run `git diff --check` and inspect the intended file list.\n- For objective workflows, create or update `evals\u002Fevals.json` and forward-test\n  representative cases against the prior version.\n\nIf tooling is unavailable, state that fact and perform a manual static check.\nDo not convert missing validation into a pass.\n\n## Common Report\n\nUse a concise report proportional to the operation:\n\n```text\nIntent:\nRuntime and scope:\nSource:\nTarget and scope:\nOwnership:\nDry run or comparison:\nBackup:\nChanged files:\nValidation:\nUnverified:\nRestart needed:\n```\n\nUse the operation-specific templates in\n[references\u002Fgovernance-and-reporting.md](references\u002Fgovernance-and-reporting.md)\nwhen more detail materially helps.\n\n## Stop Conditions\n\nStop and request direction when:\n\n- Source trust is insufficient for installation or overwrite.\n- Local edits would be overwritten without a backup or merge rule.\n- A target cannot be proven strictly below the intended root.\n- The target is system\u002Fplugin-managed without explicit override authority.\n- A material merge conflict changes behavior and intent does not resolve it.\n- Credentials, admin approval, license acceptance, or interactive\n  authentication are required.\n- The requested conclusion is stronger than the evidence.\n\nReport facts, hypotheses, validation paths, and temporary mitigation instead\nof guessing past a stop condition.\n","# Skill Lifecycle Manager\n\nOrchestrate skill work as one evidence-backed lifecycle. Keep source,\ninstallation, and ownership separate so an update to one copy does not silently\noverwrite another.\n\n## Invocation Boundary\n\nUse this skill only to upgrade Skills, synchronize Skill copies, determine a\nSkill's source, or determine who owns and may update a Skill. For every other\nSkill-related request, continue without this skill and use the narrower\napplicable workflow.\n\n## Core Contract\n\nMaintain three boundaries throughout the task:\n\n- **Source**: where the skill came from, such as GitHub, skills.sh, a Skill Hub\n  checkout, or a local repository.\n- **Install**: where a runtime loads the active skill, such as a global user\n  root or project root.\n- **Ownership**: whether the path is user-maintained, project-maintained, or\n  system\u002Fplugin-managed.\n- **Runtime**: which loader owns the active copy, such as Codex, Claude Code,\n  an Agent Skills-compatible host, or more than one runtime.\n\nDo not treat a Skill Hub checkout, `_repos` source, plugin cache, and global\ninstall as interchangeable even when their skill names match.\n\nWhen evidence is incomplete, report known facts, candidate hypotheses,\nverification paths, and temporary mitigation. Do not present an unverified\nhypothesis as a cause or completed fix.\n\n## Start With Lifecycle Triage\n\nCreate a compact internal task card before acting:\n\n- **Intent**: discover, recommend, install, update, sync, merge, audit, cleanup,\n  package, publish, validate, or create\u002Fedit.\n- **Target**: skill name, source URL, repository path, installed path, or topic.\n- **Scope**: project, global\u002Fuser, source repository, managed root, or unknown.\n- **Runtime**: Codex, Claude Code, multiple runtimes, or unknown. Do not assume\n  the runtime executing this skill is the runtime whose skills are being\n  managed.\n- **Destructive risk**: none, overwrite, move, delete, cleanup, or ownership\n  change.\n- **Evidence needed**: source, version, usage, quality, or scope proof.\n- **Companion skill**: `find-skills`, `skill-installer`, `skill-creator`, or no\n  companion.\n\nProceed without asking when target, scope, and ownership are clear. Ask a short\nquestion only when a reasonable assumption could modify the wrong skill or\ncross an ownership boundary.\n\n## Route To The Relevant Reference\n\nRead the complete relevant reference before performing that operation:\n\n| Operation | Required reference |\n| --- | --- |\n| Skill Hub pull, push, new-skill sync, junction, or index rebuild | [references\u002Fskill-hub-operations.md](references\u002Fskill-hub-operations.md) |\n| Upstream comparison, `skill-upgrade`, `check_upstreams.ps1`, mirror, or local fast-forward | [references\u002Fupstream-audit.md](references\u002Fupstream-audit.md) |\n| Runtime roots, Claude Code skills\u002Fplugins, scope precedence, cache ownership, or reload behavior | [references\u002Fruntime-adapters.md](references\u002Fruntime-adapters.md) |\n| Discovery, recommendation, install scope, quality audit, usage cleanup, package, publish, or report format | [references\u002Fgovernance-and-reporting.md](references\u002Fgovernance-and-reporting.md) |\n\nRead more than one reference when the task crosses those boundaries. Do not\nload unrelated operational detail for a simple task.\n\n## Discover Stores And Ownership\n\nDiscover actual roots before editing. Common roots include:\n\n- User\u002Fglobal roots: current Codex user skills belong in `~\u002F.agents\u002Fskills`.\n  `$CODEX_HOME\u002Fskills` (normally `~\u002F.codex\u002Fskills`) is a deprecated\n  compatibility location for older Codex installs; migrate user-owned skills\n  from it instead of choosing it for new installs. Claude Code personal skills\n  live under `${CLAUDE_CONFIG_DIR:-~\u002F.claude}\u002Fskills`.\n- Project roots: current Codex project skills use `.agents\u002Fskills` from the\n  working directory through the repository root. Treat project `.codex\u002Fskills`\n  as compatibility state. Claude Code uses `.claude\u002Fskills` and can also\n  discover nested package roots in a monorepo.\n- Source checkouts: `_repos`, Skill Hub clones, submodules, or manual clones.\n- Managed roots: `.system` skills and plugin caches. Claude Code marketplace\n  plugins are managed through `claude plugin`, not by editing\n  `~\u002F.claude\u002Fplugins\u002Fcache`.\n- Evidence indexes: a repository `_meta\u002Fskill-upstreams.json` or a local\n  source index such as `~\u002F.skill-lifecycle\u002Fskill-upstreams.json`; legacy\n  `~\u002F.agents\u002Fskill-upstreams.json` remains supported. `skills-lock.json` is an\n  inventory, not proof of upstream identity.\n\n`CLAUDE_CONFIG_DIR` relocates Claude Code's configuration and personal skills;\nit does not relocate the runtime-neutral source index. Keep the default index\nunder the operating-system user home unless `-IndexPath` is explicit. Likewise,\n`~\u002F.agents\u002Fskills` is a shared Agent Skills root even though current Codex loads\nit at user scope. Record Codex ownership only when loader or configuration\nevidence establishes it; the path alone does not prove exclusive ownership.\n\nTreat managed roots as read-only unless the user explicitly authorizes an\noverride. Treat source checkouts as source evidence, not automatically as the\nactive install target.\n\nKeep an internal inventory:\n\n| Skill | Runtime\u002Fscope | Source | Active install | Owner | Intended action |\n| --- | --- | --- | --- | --- | --- |\n\n## Lifecycle Safety Sequence\n\nUse this sequence for any operation that can change state:\n\n1. Inventory source, install, ownership, branch\u002Fref, and dirty state.\n2. Verify source and scope with evidence appropriate to the operation.\n3. Compare behavior and files before deciding replace versus merge.\n4. Run a dry run when supported.\n5. Resolve target paths and prove they are strictly below the intended root.\n6. Create a timestamped backup before overwrite, mirror, move, or deletion.\n7. Apply only the requested, ownership-compatible change.\n8. Validate source and installed copies separately when both exist.\n9. Report source, target, backup, changed files, validation, and unverified\n   items.\n\nA path equal to the allowed root is not a valid child target. A path that only\nshares the root's text prefix is also not inside that root.\n\n## Create Or Edit Skills\n\nUse `skill-creator` for SKILL.md design, progressive disclosure, scripts,\nreferences, and evals. This manager owns placement and lifecycle decisions:\n\n- Put broadly reusable, trusted workflows in a global\u002Fuser root and a shared\n  Skill Hub path when repository publication is intended.\n- Put project-specific conventions, private workflows, or experiments in a\n  project root.\n- Avoid same-name duplicates across active roots unless the user explicitly\n  wants scope-specific variants.\n- Validate the source copy before installing it, then compare source and\n  installed hashes.\n- For Claude Code, use personal or project `.claude\u002Fskills` for standalone\n  skills and a plugin only when namespaced distribution, versioned updates, or\n  bundled agents\u002Fhooks\u002FMCP are actually needed.\n\n## Discovery And Installation\n\nUse `find-skills` or the ecosystem's discovery command instead of inventing a\nnew search process. Use `skill-installer` when the requested installation flow\nmatches it.\n\nBefore recommending or installing:\n\n- Check active roots for existing or competing skills.\n- Resolve the exact repository, path, branch\u002Fref, and skill directory.\n- Read the candidate SKILL.md and inspect scripts or dependencies.\n- Record observed installs, stars, license, update activity, and source\n  reputation; mark unavailable evidence as unavailable.\n- Choose the smallest scope that supports the repeated workflow.\n\nRead [references\u002Fgovernance-and-reporting.md](references\u002Fgovernance-and-reporting.md)\nfor detailed evidence thresholds, quality checks, and report formats.\n\n## Upgrade And Merge\n\nNever upgrade by name alone. Separate source updates from active-install\nupdates:\n\n1. Resolve the exact installed path in a source index. If no verified mapping\n   exists, run the source-discovery workflow and persist the result before\n   deciding whether an upgrade exists.\n2. Verify upstream repository, skill subdirectory, branch\u002Fref, and immutable\n   comparison commit. A GitHub URL mentioned as a dependency or example is\n   only a candidate, not source proof.\n3. Compare SKILL.md, references, scripts, assets, and evals.\n4. Back up the target.\n5. Mirror only when policy and evidence permit exact replacement.\n6. Merge when local and upstream behavior both matter.\n7. Validate and report the final source\u002Finstall relationship.\n\nTreat source mapping as reusable lifecycle state, not one-off research. Key\nlocal mappings by canonical installed path so two same-name skills cannot\ninherit each other's upstream. On each later audit, refresh the verified ref,\nrecord the observed commit, and compare the complete skill directory. Read\n[references\u002Fupstream-audit.md](references\u002Fupstream-audit.md) for the bootstrap,\nverification, index, and repeat-audit workflow.\n\nFor Claude Code marketplace plugins, the plugin manager is the lifecycle\nauthority. Inventory with `claude plugin list --json`, compare the declared\nmarketplace\u002Fversion\u002Fsource, preserve the installed scope in\n`claude plugin update \u003Cplugin> --scope \u003Cscope>`, and follow the CLI's restart\ninstruction; never mirror files into the versioned plugin cache. Read\n[references\u002Fruntime-adapters.md](references\u002Fruntime-adapters.md) before acting.\n\nDo not invent lifecycle metadata or policy. `source`, `repository`, `version`,\nor similar frontmatter fields are useful only when actually present and remain\ncandidate evidence until verified. Do not assume semantic versions, automatic\npolling, retry-count downgrades, a `stale` classification, or time-based\nthresholds unless the source index or user policy defines them.\n\nWhen both versions changed, summarize behavior-level differences before\nmerging:\n\n- Triggering and description\n- Tools and dependencies\n- Safety and destructive operations\n- Output contract\n- Scripts, references, assets, and evals\n\nRead [references\u002Fupstream-audit.md](references\u002Fupstream-audit.md) before using\nthe bundled audit helper or applying a mirror.\n\n## Quality, Cleanup, And Publishing\n\nFor quality audits, check frontmatter, trigger specificity, progressive\ndisclosure, referenced resources, script safety, dependencies, secrets,\nabsolute-path leakage, and objective eval coverage.\n\nFor usage cleanup, do not use filesystem `LastAccessTime` as proof. Prefer\nexplicit invocation evidence, session\u002Ftool logs, loadability metadata, then\nfilesystem presence. Quarantine uncertain candidates instead of deleting them.\n\nFor publishing, complete and save the quality and secret\u002Fprivacy audit before\ncreating or copying the package. Scan file contents as well as names, including\nquoted JSON\u002FYAML credential keys, environment assignments, tokens, private\nkeys, personal paths, and identifiers. Treat an unreadable file or an\nunclassified finding as a failed gate; do not package first and repair the\naudit afterward. Then keep only allowlisted runtime-relevant skill files,\nremove generated outputs and private data, record provenance, update indexes,\nand deliberately synchronize source and installed copies.\n\nRead [references\u002Fgovernance-and-reporting.md](references\u002Fgovernance-and-reporting.md)\nfor the full gates, evidence labels, and output templates.\n\n## Validation\n\nUse the strongest relevant validation:\n\n- Parse frontmatter and required fields.\n- Run `skill-creator` validation.\n- Run bundled script self-tests or safe dry runs.\n- Parse JSON indexes and compare indexed counts with actual SKILL.md files.\n- Run `git diff --check` and inspect the intended file list.\n- For objective workflows, create or update `evals\u002Fevals.json` and forward-test\n  representative cases against the prior version.\n\nIf tooling is unavailable, state that fact and perform a manual static check.\nDo not convert missing validation into a pass.\n\n## Common Report\n\nUse a concise report proportional to the operation:\n\n```text\nIntent:\nRuntime and scope:\nSource:\nTarget and scope:\nOwnership:\nDry run or comparison:\nBackup:\nChanged files:\nValidation:\nUnverified:\nRestart needed:\n```\n\nUse the operation-specific templates in\n[references\u002Fgovernance-and-reporting.md](references\u002Fgovernance-and-reporting.md)\nwhen more detail materially helps.\n\n## Stop Conditions\n\nStop and request direction when:\n\n- Source trust is insufficient for installation or overwrite.\n- Local edits would be overwritten without a backup or merge rule.\n- A target cannot be proven strictly below the intended root.\n- The target is system\u002Fplugin-managed without explicit override authority.\n- A material merge conflict changes behavior and intent does not resolve it.\n- Credentials, admin approval, license acceptance, or interactive\n  authentication are required.\n- The requested conclusion is stronger than the evidence.\n\nReport facts, hypotheses, validation paths, and temporary mitigation instead\nof guessing past a stop condition.\n",{"name":5,"description":7},"mine","1e7390741dffd3d5041fca4ebc056071ee3ba137","archives\u002Fuser-installed-skills\u002Fskill-lifecycle-manager\u002F0143a0d1372a542a\u002Fskill-lifecycle-manager",5,"https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub","https:\u002F\u002Fgithub.com\u002FEthanYoQ","www.orz.md","Part Marketer, Part AI Explorer.","2026-11-07 14:52:29",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add EthanYoQ\u002FSkill-hub --skill skill-lifecycle-manager",{"tool":64,"command":65},"bunx","bunx skills add EthanYoQ\u002FSkill-hub --skill skill-lifecycle-manager",{"tool":67,"command":68},"pnpm","pnpm dlx skills add EthanYoQ\u002FSkill-hub --skill skill-lifecycle-manager","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Farchives\u002Fuser-installed-skills\u002Fskill-lifecycle-manager\u002F0143a0d1372a542a\u002Fskill-lifecycle-manager\u002FSKILL.md",true,[72,78,82,86,90,94],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"evals\u002Fevals.json","REFERENCE","参考文档",13285,"https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Farchives\u002Fuser-installed-skills\u002Fskill-lifecycle-manager\u002F0143a0d1372a542a\u002Fskill-lifecycle-manager\u002Fevals\u002Fevals.json",{"path":79,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fgovernance-and-reporting.md",6401,"https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Farchives\u002Fuser-installed-skills\u002Fskill-lifecycle-manager\u002F0143a0d1372a542a\u002Fskill-lifecycle-manager\u002Freferences\u002Fgovernance-and-reporting.md",{"path":83,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fruntime-adapters.md",7234,"https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Farchives\u002Fuser-installed-skills\u002Fskill-lifecycle-manager\u002F0143a0d1372a542a\u002Fskill-lifecycle-manager\u002Freferences\u002Fruntime-adapters.md",{"path":87,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fskill-hub-operations.md",5844,"https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Farchives\u002Fuser-installed-skills\u002Fskill-lifecycle-manager\u002F0143a0d1372a542a\u002Fskill-lifecycle-manager\u002Freferences\u002Fskill-hub-operations.md",{"path":91,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fupstream-audit.md",10836,"https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Farchives\u002Fuser-installed-skills\u002Fskill-lifecycle-manager\u002F0143a0d1372a542a\u002Fskill-lifecycle-manager\u002Freferences\u002Fupstream-audit.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fcheck_upstreams.ps1","SCRIPT","脚本",39939,"https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Farchives\u002Fuser-installed-skills\u002Fskill-lifecycle-manager\u002F0143a0d1372a542a\u002Fskill-lifecycle-manager\u002Fscripts\u002Fcheck_upstreams.ps1",[101,128,159,183,201,216],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":108,"publishedAt":44},"01M713CBDSYARG4PXFXK2R2NNN","xhs-pharma-social-listening","Run evidence-disciplined Xiaohongshu social listening for foreign pharma employee pain points. Use when the user asks to collect and analyze notes\u002Fcomments about pharma companies, aliases, roles, compliance, medical affairs, or AI topics, then produce a cited and scored sampled-insight report. Includes independent-evidence counting, MediaCrawler batch collection, and CAPTCHA\u002F461 fallback to Agent Reach\u002FOpenCLI.","https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Fskills\u002F10-business-industry\u002Fxhs-pharma-social-listening\u002FSKILL.md",[107],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,30,126,127],"social","xhs pharma social listening","social listening","xhs","medical","counting","when","collection","batch","analyze","notes","run","opencli","fallback","captcha","agent reach","evidence","collect","produce",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":140,"publishedAt":44},"01M713C8Q76ZP0WXXBRAFKS6EE","healthcare-phi-compliance","Protected Health Information (PHI) and Personally Identifiable Information (PII) compliance patterns for healthcare applications. Covers data classification, access control, audit trails, encryption, and common leak vectors. Use when code touches PHI or PII in a healthcare system, or when auditing access control, audit trails, or leak vectors.","https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Fskills\u002F10-business-industry\u002Fhealthcare-phi-compliance\u002FSKILL.md",[134,135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":136,"categoryName":137,"taxonomyType":138,"taxonomyTypeDesc":139},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[141,142,143,144,145,146,147,148,115,149,150,151,152,153,154,155,30,156,157,158],"healthcare","phi","compliance","healthcare phi compliance","pii","compliance patterns","information","access","encryption","code","common","audit","data","patterns","Access Control","system","applications","Auditing Access Control",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":166,"publishedAt":44},"01M713C5R2GE43X45T2K75TB76","healthcare-eval-harness","Patient safety evaluation harness for healthcare application deployments. Automated test suites for CDSS accuracy, PHI exposure, clinical workflow integrity, and integration compliance. Blocks deployments on safety failures. Use when a healthcare deployment must be gated on patient-safety tests for CDSS accuracy, PHI exposure, and workflow integrity.","https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Fskills\u002F10-business-industry\u002Fhealthcare-eval-harness\u002FSKILL.md",[165],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,167,168,169,170,171,172,115,173,174,175,176,142,30,177,178,179,180,181,182],"eval","harness","healthcare eval harness","eval harness","clinical","patient","workflow","Evaluation","Safety","integrity","deployment","accuracy","tests","deployments","use","super",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":190,"publishedAt":44},"01M713C2J17S91VYR7A8M696VR","healthcare-emr-patterns","EMR\u002FEHR development patterns for healthcare applications. Clinical safety, encounter workflows, prescription generation, clinical decision support integration, and accessibility-first UI for medical data entry. Use when building EMR or EHR features such as encounter workflows, prescription generation, or clinical data entry UI.","https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Fskills\u002F10-business-industry\u002Fhealthcare-emr-patterns\u002FSKILL.md",[189],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,191,154,192,193,113,171,194,115,195,196,197,175,153,198,199,200,30,157,181],"EMR","healthcare emr patterns","decision","workflows","support","clinical decision support","features","ui","as","development",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":44},"01M713BZERTXV0N8X6SW9DDVWZ","healthcare-cdss-patterns","Clinical Decision Support System (CDSS) development patterns. Drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), alert severity classification, and integration into EMR workflows. Use when building clinical decision support — drug interaction checks, dose validation, clinical scoring, or alert severity.","https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Fskills\u002F10-business-industry\u002Fhealthcare-cdss-patterns\u002FSKILL.md",[207],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[141,154,209,193,171,191,194,115,210,211,195,196,212,200,156,213,181,214,182,215],"healthcare cdss patterns","scoring","interaction","severity","classification","alert","decision support",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":44},"01M713BVK3PQR7V4ZKYGMWMXJD","dxy-task-clarify","用户的请求含糊、缺背景、缺资料说明、缺读者或用途时使用。先用少量带选项的追问把任务问清楚，写成任务卡，用户确认后再执行。尤其适用于医生、科研人员和药企各岗位的工作，例如「帮我分析一下这些数据」「帮我准备明天的拜访」「写个总结」「做个 PPT」「回一下这封邮件」「整理一下会议纪要」「整理一下这些文献」「帮我准备下周的讲课」「写个病例汇报」「帮我写个提示词」。用户说「先问我」「帮我理清需求」「我不知道怎么描述」「我不会问 AI」时也使用。用途、资料、读者都已说清的请求，纯翻译，以及写代码、改代码，不使用。","https:\u002F\u002Fgithub.com\u002FEthanYoQ\u002FSkill-hub\u002Fblob\u002Fmine\u002Fskills\u002F10-business-industry\u002Fdxy-task-clarify\u002FSKILL.md",[222],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,227,228,229,230,231],"clarify","dxy task clarify","task","pptx","整理","翻译","数据","总结"]