[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C8RNAVC9NYSYAFK693GSQ":3,"skill-same:01M71C8RNAVC9NYSYAFK693GSQ":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M71C8RNAVC9NYSYAFK693GSQ","fork-and-publish-skill",null,"Customizes an installed agent skill and ships it back upstream or as a versioned fork using qvr's edit\u002Fpublish authoring loop. Use when a user wants to modify, customize, fork, release, or publish a qvr skill — e.g. \"edit this skill\", \"publish my changes\", \"fork a skill to my own repo\", \"cut a v1.0.0 release of a skill\", or \"iterate on a skill and tag new versions\". Covers qvr edit, diff, status, and publish (--fork --migrate --tag, --auto-commit, root vs nested layout), including the consume-mode round trip.","try-agora\u002Fqvr","try-agora","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F291123208?v=4","01M71C8JCBG20FR84774RF053Q","AGORA","01M71C8JCYSVRHPDR1EV8T0WN8",26,"MIT","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Fskills\u002Ffork-and-publish-skill\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"fork and publish skill","fork","publish","my","playground","authoring","a skill","status","edit","release","cut","layout","commit","migrate","when","loop","auto","new","mode","back","2026-11-10 10:12:30",false,"---\nname: fork-and-publish-skill\ndescription: >\n  Customizes an installed agent skill and ships it back upstream or as a versioned\n  fork using qvr's edit\u002Fpublish authoring loop. Use when a user wants to modify,\n  customize, fork, release, or publish a qvr skill — e.g. \"edit this skill\",\n  \"publish my changes\", \"fork a skill to my own repo\", \"cut a v1.0.0 release of a\n  skill\", or \"iterate on a skill and tag new versions\". Covers qvr edit, diff,\n  status, and publish (--fork --migrate --tag, --auto-commit, root vs nested\n  layout), including the consume-mode round trip.\nmetadata:\n  author: quiver-playground\n  version: \"1.0.0\"\n---\n\n# Fork and publish a skill with qvr\n\nqvr lets you take an installed skill, **eject** it into your project to edit\ndirectly, then **publish** the result — either back to its origin or to a brand\nnew fork you own — cutting tagged releases as you go. After each publish the lock\nentry flips back to consume mode, so you can iterate: edit → publish v0.2.0 →\nedit → publish v0.3.0. This skill drives that loop.\n\n## When to use this\n\n- The user wants to tweak a skill's content and keep the change.\n- They want to publish a skill back upstream, or fork it to a repo they control.\n- They want to cut tagged releases and iterate version by version.\n\nFor installing\u002Fdiscovering skills use `onboard-skills`; for verifying provenance\nof what you publish use `verify-skill-supply-chain`.\n\n## Prerequisites\n\n- The skill must be **installed in a project** (not only `--global`). Editing a\n  global skill in place would mutate a copy every project shares, so it's not\n  supported. To change a global skill: `qvr add \u003Cskill>` into a project, edit and\n  publish there, then re-add the published version with `--global`.\n- A clean-ish working state helps; `publish` refuses a dirty eject dir unless you\n  pass `--auto-commit`.\n\n## Workflow\n\n### 1. Eject the skill for editing\n\n`qvr edit` promotes the symlinked skill into a real directory under the canonical\nagent target (the alphabetical-first installed target — e.g. `.claude\u002Fskills\u002F\u003Cname>\u002F`\nor `.cursor\u002Frules\u002F\u003Cname>\u002F`, depending on what you installed into); any other\ninstalled target dirs become relative symlinks to it. The lock entry gains\n`mode = 'edit'`.\n\n```\nqvr edit my-skill\nqvr edit my-skill --author \"Jane Dev\" --email jane@example.com   # initial-commit identity\n```\n\nIt's idempotent — running it again after the first eject is a no-op.\n\n### 2. Make and review changes\n\nEdit the files in the ejected skill directory (the canonical agent target), then\nreview:\n\n```\nqvr diff my-skill           # git diff in the skill worktree\nqvr diff my-skill --stat\nqvr status my-skill         # dirty state + git ahead\u002Fbehind\n```\n\n### 3a. Publish back to the original upstream\n\n```\nqvr publish my-skill -m \"Fix edge case\" --tag v1.0.1\nqvr publish my-skill --dry-run -m \"...\"     # validate and stage without pushing\nqvr publish my-skill --auto-commit -m \"...\" # stage+commit a dirty eject dir first\n```\n\n### 3b. Fork to a new repo you own\n\nUse `--fork \u003Cgit-url>` to retarget the push, and `--migrate` to rewrite the lock\nentry so **future** publishes track the fork:\n\n```\nqvr publish my-skill --fork https:\u002F\u002Fgithub.com\u002Fme\u002Fmy-skill.git --migrate --tag v0.1.0\n```\n\n`--fork --migrate` auto-registers the fork as a config registry named\n`\u003Corg>\u002F\u003Crepo>` (e.g. `me\u002Fmy-skill`). To re-add the skill from it later, use that\n**full** name:\n\n```\nqvr add my-skill --registry me\u002Fmy-skill\n```\n\n`--layout` controls the published repo shape: `root` (single-skill repo, the\ndefault for `--fork`) or `nested` (multi-skill registry under `skills\u002F\u003Cname>\u002F`,\nthe default otherwise).\n\n### 4. Iterate releases\n\nEach publish flips the entry back to consume mode, so the loop repeats cleanly:\n\n```\nqvr edit my-skill\n# ...changes...\nqvr publish my-skill --tag v0.2.0\nqvr edit my-skill\n# ...changes...\nqvr publish my-skill --tag v0.3.0\n```\n\nConsumers pick up a release with the version manager:\n\n```\nqvr outdated                  # which installs have newer upstream commits\nqvr switch my-skill v0.3.0    # explicit pin\nqvr switch my-skill --latest  # jump to the latest semver tag\nqvr pull my-skill             # fast-forward the current ref (alias of switch --tip)\n```\n\n### 5. Add a new skill to a registry (greenfield path mode)\n\nTo publish a brand-new local skill directory into a multi-skill registry repo:\n\n```\nqvr publish .\u002Fmy-new-skill --registry me\u002Fagent-skills -m \"Add my-new-skill\"\n```\n\n## Gotchas\n\n- **Dirty eject dirs are refused.** `publish` won't push uncommitted changes\n  unless you pass `--auto-commit` (which stages + commits first).\n- **`--migrate` only matters with `--fork`.** Without it, the fork push is\n  one-off and the lock entry still tracks the original upstream.\n- **Registry name after a fork is the full `\u003Corg>\u002F\u003Crepo>`**, not a short alias —\n  `qvr add … --registry`, `registry list`, and `registry update` all need it.\n- **Clean up edit ejects before teardown.** A `sync` with a drifted\u002Fejected entry\n  **fails** asking for `--allow-drift`; publish or revert the eject first (or\n  re-consume the skill) before a `cache clean` + `sync`.\n- **Lockfile\u002FHEAD mismatch** is refused for integrity; only override with\n  `--allow-lockfile-heal` if you understand why HEAD diverged.\n\n## Troubleshooting\n\n- *\"refusing dirty working directory\"* — commit the eject, or pass `--auto-commit`.\n- *Second release fails to resolve the commit* — make sure each iteration goes\n  through `qvr edit` again; the entry must be back in edit mode to publish.\n- *`qvr add --registry \u003Calias>` can't find the fork* — use the full `\u003Corg>\u002F\u003Crepo>`\n  name that `--fork --migrate` registered, visible in `qvr registry list`.\n- *Want to undo an eject without publishing* — re-consume the skill (re-`add` \u002F\n  `switch` to a ref); confirm with `qvr status` and `qvr sync`.\n","# Fork and publish a skill with qvr\n\nqvr lets you take an installed skill, **eject** it into your project to edit\ndirectly, then **publish** the result — either back to its origin or to a brand\nnew fork you own — cutting tagged releases as you go. After each publish the lock\nentry flips back to consume mode, so you can iterate: edit → publish v0.2.0 →\nedit → publish v0.3.0. This skill drives that loop.\n\n## When to use this\n\n- The user wants to tweak a skill's content and keep the change.\n- They want to publish a skill back upstream, or fork it to a repo they control.\n- They want to cut tagged releases and iterate version by version.\n\nFor installing\u002Fdiscovering skills use `onboard-skills`; for verifying provenance\nof what you publish use `verify-skill-supply-chain`.\n\n## Prerequisites\n\n- The skill must be **installed in a project** (not only `--global`). Editing a\n  global skill in place would mutate a copy every project shares, so it's not\n  supported. To change a global skill: `qvr add \u003Cskill>` into a project, edit and\n  publish there, then re-add the published version with `--global`.\n- A clean-ish working state helps; `publish` refuses a dirty eject dir unless you\n  pass `--auto-commit`.\n\n## Workflow\n\n### 1. Eject the skill for editing\n\n`qvr edit` promotes the symlinked skill into a real directory under the canonical\nagent target (the alphabetical-first installed target — e.g. `.claude\u002Fskills\u002F\u003Cname>\u002F`\nor `.cursor\u002Frules\u002F\u003Cname>\u002F`, depending on what you installed into); any other\ninstalled target dirs become relative symlinks to it. The lock entry gains\n`mode = 'edit'`.\n\n```\nqvr edit my-skill\nqvr edit my-skill --author \"Jane Dev\" --email jane@example.com   # initial-commit identity\n```\n\nIt's idempotent — running it again after the first eject is a no-op.\n\n### 2. Make and review changes\n\nEdit the files in the ejected skill directory (the canonical agent target), then\nreview:\n\n```\nqvr diff my-skill           # git diff in the skill worktree\nqvr diff my-skill --stat\nqvr status my-skill         # dirty state + git ahead\u002Fbehind\n```\n\n### 3a. Publish back to the original upstream\n\n```\nqvr publish my-skill -m \"Fix edge case\" --tag v1.0.1\nqvr publish my-skill --dry-run -m \"...\"     # validate and stage without pushing\nqvr publish my-skill --auto-commit -m \"...\" # stage+commit a dirty eject dir first\n```\n\n### 3b. Fork to a new repo you own\n\nUse `--fork \u003Cgit-url>` to retarget the push, and `--migrate` to rewrite the lock\nentry so **future** publishes track the fork:\n\n```\nqvr publish my-skill --fork https:\u002F\u002Fgithub.com\u002Fme\u002Fmy-skill.git --migrate --tag v0.1.0\n```\n\n`--fork --migrate` auto-registers the fork as a config registry named\n`\u003Corg>\u002F\u003Crepo>` (e.g. `me\u002Fmy-skill`). To re-add the skill from it later, use that\n**full** name:\n\n```\nqvr add my-skill --registry me\u002Fmy-skill\n```\n\n`--layout` controls the published repo shape: `root` (single-skill repo, the\ndefault for `--fork`) or `nested` (multi-skill registry under `skills\u002F\u003Cname>\u002F`,\nthe default otherwise).\n\n### 4. Iterate releases\n\nEach publish flips the entry back to consume mode, so the loop repeats cleanly:\n\n```\nqvr edit my-skill\n# ...changes...\nqvr publish my-skill --tag v0.2.0\nqvr edit my-skill\n# ...changes...\nqvr publish my-skill --tag v0.3.0\n```\n\nConsumers pick up a release with the version manager:\n\n```\nqvr outdated                  # which installs have newer upstream commits\nqvr switch my-skill v0.3.0    # explicit pin\nqvr switch my-skill --latest  # jump to the latest semver tag\nqvr pull my-skill             # fast-forward the current ref (alias of switch --tip)\n```\n\n### 5. Add a new skill to a registry (greenfield path mode)\n\nTo publish a brand-new local skill directory into a multi-skill registry repo:\n\n```\nqvr publish .\u002Fmy-new-skill --registry me\u002Fagent-skills -m \"Add my-new-skill\"\n```\n\n## Gotchas\n\n- **Dirty eject dirs are refused.** `publish` won't push uncommitted changes\n  unless you pass `--auto-commit` (which stages + commits first).\n- **`--migrate` only matters with `--fork`.** Without it, the fork push is\n  one-off and the lock entry still tracks the original upstream.\n- **Registry name after a fork is the full `\u003Corg>\u002F\u003Crepo>`**, not a short alias —\n  `qvr add … --registry`, `registry list`, and `registry update` all need it.\n- **Clean up edit ejects before teardown.** A `sync` with a drifted\u002Fejected entry\n  **fails** asking for `--allow-drift`; publish or revert the eject first (or\n  re-consume the skill) before a `cache clean` + `sync`.\n- **Lockfile\u002FHEAD mismatch** is refused for integrity; only override with\n  `--allow-lockfile-heal` if you understand why HEAD diverged.\n\n## Troubleshooting\n\n- *\"refusing dirty working directory\"* — commit the eject, or pass `--auto-commit`.\n- *Second release fails to resolve the commit* — make sure each iteration goes\n  through `qvr edit` again; the entry must be back in edit mode to publish.\n- *`qvr add --registry \u003Calias>` can't find the fork* — use the full `\u003Corg>\u002F\u003Crepo>`\n  name that `--fork --migrate` registered, visible in `qvr registry list`.\n- *Want to undo an eject without publishing* — re-consume the skill (re-`add` \u002F\n  `switch` to a ref); confirm with `qvr status` and `qvr sync`.\n",{"name":5,"metadata":49,"description":52},{"author":50,"version":51},"quiver-playground","1.0.0","Customizes an installed agent skill and ships it back upstream or as a versioned fork using qvr's edit\u002Fpublish authoring loop. Use when a user wants to modify, customize, fork, release, or publish a qvr skill — e.g. \"edit this skill\", \"publish my changes\", \"fork a skill to my own repo\", \"cut a v1.0.0 release of a skill\", or \"iterate on a skill and tag new versions\". Covers qvr edit, diff, status, and publish (--fork --migrate --tag, --auto-commit, root vs nested layout), including the consume-mode round trip.\n","main","71783910729031afe6ad1d640728b1534ee4c198","skills\u002Ffork-and-publish-skill",0,"https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr","https:\u002F\u002Fgithub.com\u002Ftry-agora","sdlc tools for multiplayer coding","2026-07-01 02:12:06",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add try-agora\u002Fqvr --skill fork-and-publish-skill",{"tool":67,"command":68},"bunx","bunx skills add try-agora\u002Fqvr --skill fork-and-publish-skill",{"tool":70,"command":71},"pnpm","pnpm dlx skills add try-agora\u002Fqvr --skill fork-and-publish-skill","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Fskills\u002Ffork-and-publish-skill\u002FSKILL.md",true,[],[76,105,118,136,159,177],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":86,"publishedAt":44},"01M71CAMTR0ADSZQ9CYFW363D8","valid-skill","A valid test skill for unit testing. Use when testing the quiver validation pipeline to ensure correct skills pass all checks.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fvalid-skill\u002FSKILL.md",[82,85],{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[87,88,89,90,91,92,93,94,95,96,97,98,38,99,100,101,102,103,104],"valid skill","valid","org","use","unit testing","git","grep","validation","read","test","Test Skill","Bash","quiver","testing","correct","pipeline","for","unit",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":113,"publishedAt":44},"01M71CAK6B219E10ZPYX0C4JK8","example-skill","An example skill for testing registry discovery.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fsample-registry\u002Fskills\u002Fexample-skill\u002FSKILL.md",[111,112],{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,103,96,116,89,117,100],"example skill","example","discovery","registry",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":125,"publishedAt":44},"01M71CAHR5A0MTDYXHDDE19TJR","malicious-skill-unicode","Fixture for the unicode check. Contains hidden zero-width and bidirectional-override characters that the scanner must flag.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-unicode\u002FSKILL.md",[124],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[126,127,128,129,130,131,132,103,133,134,135],"malicious skill unicode","malicious","malicious skill","Unicode","hidden","scanner","check","ZeRO","fixture","characters",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":44},"01M71CAFJPYFFX70KKPBM9TFT8","malicious-skill-tool-misuse","Fixture exercising the tool-misuse rule family (TM1a shell=True, TM1b rm -rf root, TM1c --no-verify, TM1d chmod 777, TM3 verify=False) and SC2 curl pipe shell. Used by the scanner integration test as the canonical \"tool misuse\" sample.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-tool-misuse\u002FSKILL.md",[142],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[144,145,127,128,146,147,148,149,150,151,152,153,96,131,154,155,156,157,158,134],"tool","malicious skill tool misuse","canonical","family","shell","rm","verify","curl","pipe","sample","false","integration","true","integration test","as",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":166,"publishedAt":44},"01M71CAD9MG9F0RDRQAPH9BD08","malicious-skill-supply-chain","Fixture for the supply-chain check. Ships a requirements.txt pinning a known-vulnerable pyyaml (CVE-2020-14343), an unpinned requirement, an abandoned package, and a typosquatted name. Drives SC1\u002FSC4\u002FSC5\u002FSC6 simultaneously.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-supply-chain\u002FSKILL.md",[165],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,127,168,128,169,170,103,171,134,172,173,174,132,175,176],"supply chain","chain","supply","malicious skill supply chain","cve","unpinned","supply-chain","name","requirements","package",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":184,"publishedAt":44},"01M71CAARKXHD0HA2N67TFBJ8B","malicious-skill-signatures","Fixture for the YARA-lite signature engine. Carries a small bash reverse-shell script (YR1_bash_reverse_shell) and a minimal PHP eval webshell (YR2_php_eval_shell) so the integration test can assert both critical signature matches in a single scan.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-signatures\u002FSKILL.md",[183],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[128,185,127,186,98,187,188,96,189,190,191,192,193,194,195,157,196,103,197,134],"malicious skill signatures","signatures","yara","reverse-shell","engine","webshell","can","critical","single","eval","minimal","scan","reverse"]