[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C94W5A09H9RESHWYNFCSA":3,"skill-same:01M71C94W5A09H9RESHWYNFCSA":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M71C94W5A09H9RESHWYNFCSA","reproduce-skill-env",null,"Reproduces an exact agent-skill set across machines, teammates, and CI using qvr's portable manifest and lockfile guarantees. Use when a user wants to share, pin, replicate, or CI-gate their qvr skills — e.g. \"export my skills\", \"import this skill manifest\", \"pin everything to exact commits\", \"make skills reproducible\", \"fail CI if skills drift\", or \"onboard a teammate to the same skills\". Covers qvr export\u002Fimport, --frozen pinning, and the sync --locked \u002F sync --check CI assertions.","try-agora\u002Fqvr","try-agora","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F291123208?v=4","01M71C8JCBG20FR84774RF053Q","AGORA","01M71C8JCYSVRHPDR1EV8T0WN8",26,"MIT","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Fskills\u002Freproduce-skill-env\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"env","reproduce","reproduce skill env","use","quiver","Reproducible","commits","import","make","my","export","playground","sync","replicate","across","drift","when","ci","lockfile","SET","2026-11-10 10:12:30",false,"---\nname: reproduce-skill-env\ndescription: >\n  Reproduces an exact agent-skill set across machines, teammates, and CI using\n  qvr's portable manifest and lockfile guarantees. Use when a user wants to share,\n  pin, replicate, or CI-gate their qvr skills — e.g. \"export my skills\", \"import\n  this skill manifest\", \"pin everything to exact commits\", \"make skills\n  reproducible\", \"fail CI if skills drift\", or \"onboard a teammate to the same\n  skills\". Covers qvr export\u002Fimport, --frozen pinning, and the sync --locked \u002F\n  sync --check CI assertions.\nmetadata:\n  author: quiver-playground\n  version: \"1.0.0\"\n---\n\n# Reproduce a skill environment with qvr\n\nqvr separates *intent* from *bytes*: `qvr.lock` pins each skill to a `commit` and\na `subtreeHash`, so the exact content can be restored even if upstream refs move.\nOn top of that, `qvr export` emits a small, human-readable manifest that a\nteammate (or a CI job) can `qvr import` to rebuild the same set from scratch —\nwithout any pre-existing registry configuration. This skill covers sharing a set,\npinning it hard, and asserting reproducibility in CI.\n\n## When to use this\n\n- The user wants to share their skill set with a teammate or another machine.\n- They want byte-for-byte reproducibility (pin to exact commits, not floating\n  refs).\n- They want CI to **fail** if the checked-out skills don't match the lockfile.\n\nFor first-time discovery\u002Finstall of individual skills, use `onboard-skills`\ninstead.\n\n## Key concepts\n\n- **Manifest (export)** — a 3-column text file: repo URL, skill name, version.\n  Portable and reviewable. By default it records the ref; `--frozen` records the\n  exact pinned commit.\n- **Lockfile (`qvr.lock`)** — the authoritative TOML v5 record with commit +\n  subtreeHash. Commit it to version control.\n- **`mode: edit` \u002F `mode: link` skills** live in the project filesystem and are\n  not portable across projects; they're skipped from exports by default.\n\n## Workflow\n\n### 1. Export the current set\n\n```\nqvr export > skills.txt                          # ref-only (floating)\nqvr export --frozen > skills.lock.txt            # pin to recorded commits\nqvr export --output-file=skills.txt --include-aliases\nqvr export --include-local                        # emit edit\u002Flink skills as commented docs\n```\n\nChoose `--frozen` when you want the recipient to get the *exact same bytes*; omit\nit when you want them to track whatever the ref currently points at.\n\n### 2. Import on another machine \u002F for a teammate\n\n`qvr import` registers each source repo if needed, then installs each skill via\nthe same code path as `qvr add`:\n\n```\nqvr import skills.txt                             # register sources + install each\nqvr import skills.lock.txt                        # frozen manifest: per-line --commit= pins are honored — plain import, no qvr.lock needed\nqvr import --target=claude,cursor skills.txt      # install into specific targets\n```\n\nThe byte-exact pin lives in the manifest's `--commit=\u003Csha>` field (written by\n`export --frozen`), so a plain `qvr import` on a fresh machine already reproduces\nexact bytes — you do **not** pass `--frozen` here. `import --frozen` is a\nstricter *re-import* guard: it refuses subtreeHash drift on `--commit`-pinned\nentries and therefore requires an existing `qvr.lock` to compare against (it\nerrors `--frozen requires a readable lock file` on a from-scratch machine).\n\nPer-line failures surface as `✗ import …: \u003Creason>` on stderr; the command exits\nnon-zero if anything failed, but successful installs are kept. A URL already\nregistered under a different alias is reused silently.\n\n### 3. Commit the lockfile\n\nThe manifest bootstraps a fresh machine; the **lockfile** is what guarantees\nidentical bytes thereafter. Commit `qvr.lock` together with `qvr.toml` (and the\nmanifest, if you keep one) to version control. `qvr.toml` carries the declared\nintent and the project's default agent targets so routing travels with the repo;\n`qvr.lock` is self-sufficient, so `qvr sync` on a fresh clone rebuilds the whole\nset from the lock alone — CI never needs `qvr.toml`:\n\n```\ngit add qvr.toml qvr.lock skills.lock.txt\ngit commit -m \"Pin agent skill set\"\n```\n\n### 4. Assert reproducibility in CI\n\nUse the read-only assertions so CI fails loudly on drift or a stale lock — never\nsilently reconciles:\n\n```\nqvr sync --check       # read-only: exit non-zero if project is out of sync; writes nothing\nqvr sync --locked      # restore worktrees but make NO lock changes; fail if lock is stale or drifted\nqvr sync --frozen      # restore strictly from the lock as-is; never re-resolve or rewrite it\n```\n\nA typical CI step:\n\n```\nqvr sync --locked && qvr list\n```\n\n`--check` is the lightest gate (does not even touch the filesystem). `--locked`\nadditionally restores worktrees so the rest of the job can run against real\nskills, while still failing if a sync *would* have to modify `qvr.lock`.\n\n## Gotchas\n\n- **Pin on the export side, not the import side.** `export --frozen` bakes a\n  `--commit=\u003Csha>` into each manifest line; a plain `qvr import` of that manifest\n  reproduces exact bytes. A *ref-only* manifest (no `--frozen` export) re-resolves\n  to the ref tip on import — so the pin you keep or lose is decided at export.\n  Don't reach for `import --frozen` to \"keep the pin\": it's a re-import drift-guard\n  that needs an existing `qvr.lock` and fails on a from-scratch machine.\n- **`--allow-drift` defeats the purpose.** It downgrades subtreeHash drift to a\n  warning; it's a rare local-debug escape hatch and must never appear in CI.\n- **Edit\u002Flink skills don't travel.** They live in the project tree. Export them\n  with `--include-local` only as documentation; the recipient must re-create them\n  (see `fork-and-publish-skill`).\n- **Manifest ≠ lockfile.** The manifest is for bootstrapping a new environment;\n  the lockfile is the reproducibility guarantee. Keep both in sync by re-exporting\n  after you change the set.\n\n## Troubleshooting\n\n- *CI passes locally but fails in the pipeline* — the lock is likely stale or an\n  entry drifted. Reproduce with `qvr sync --locked`; inspect with\n  `qvr lock verify` and `qvr status` (see `verify-skill-supply-chain`).\n- *Import installs a different commit than expected* — you imported a ref-only\n  manifest. Re-export with `--frozen` (which embeds `--commit=` pins) and import\n  it plainly; the pins are honored without an import-side `--frozen` flag.\n- *`--frozen requires a readable lock file`* — you passed `import --frozen` on a\n  fresh machine with no `qvr.lock`. Drop `--frozen`: a plain `import` of a frozen\n  (commit-pinned) manifest is already byte-exact.\n- *A skill silently missing after import* — it was an `edit`\u002F`link` (local) skill,\n  skipped by default. Re-create it in the project.\n","# Reproduce a skill environment with qvr\n\nqvr separates *intent* from *bytes*: `qvr.lock` pins each skill to a `commit` and\na `subtreeHash`, so the exact content can be restored even if upstream refs move.\nOn top of that, `qvr export` emits a small, human-readable manifest that a\nteammate (or a CI job) can `qvr import` to rebuild the same set from scratch —\nwithout any pre-existing registry configuration. This skill covers sharing a set,\npinning it hard, and asserting reproducibility in CI.\n\n## When to use this\n\n- The user wants to share their skill set with a teammate or another machine.\n- They want byte-for-byte reproducibility (pin to exact commits, not floating\n  refs).\n- They want CI to **fail** if the checked-out skills don't match the lockfile.\n\nFor first-time discovery\u002Finstall of individual skills, use `onboard-skills`\ninstead.\n\n## Key concepts\n\n- **Manifest (export)** — a 3-column text file: repo URL, skill name, version.\n  Portable and reviewable. By default it records the ref; `--frozen` records the\n  exact pinned commit.\n- **Lockfile (`qvr.lock`)** — the authoritative TOML v5 record with commit +\n  subtreeHash. Commit it to version control.\n- **`mode: edit` \u002F `mode: link` skills** live in the project filesystem and are\n  not portable across projects; they're skipped from exports by default.\n\n## Workflow\n\n### 1. Export the current set\n\n```\nqvr export > skills.txt                          # ref-only (floating)\nqvr export --frozen > skills.lock.txt            # pin to recorded commits\nqvr export --output-file=skills.txt --include-aliases\nqvr export --include-local                        # emit edit\u002Flink skills as commented docs\n```\n\nChoose `--frozen` when you want the recipient to get the *exact same bytes*; omit\nit when you want them to track whatever the ref currently points at.\n\n### 2. Import on another machine \u002F for a teammate\n\n`qvr import` registers each source repo if needed, then installs each skill via\nthe same code path as `qvr add`:\n\n```\nqvr import skills.txt                             # register sources + install each\nqvr import skills.lock.txt                        # frozen manifest: per-line --commit= pins are honored — plain import, no qvr.lock needed\nqvr import --target=claude,cursor skills.txt      # install into specific targets\n```\n\nThe byte-exact pin lives in the manifest's `--commit=\u003Csha>` field (written by\n`export --frozen`), so a plain `qvr import` on a fresh machine already reproduces\nexact bytes — you do **not** pass `--frozen` here. `import --frozen` is a\nstricter *re-import* guard: it refuses subtreeHash drift on `--commit`-pinned\nentries and therefore requires an existing `qvr.lock` to compare against (it\nerrors `--frozen requires a readable lock file` on a from-scratch machine).\n\nPer-line failures surface as `✗ import …: \u003Creason>` on stderr; the command exits\nnon-zero if anything failed, but successful installs are kept. A URL already\nregistered under a different alias is reused silently.\n\n### 3. Commit the lockfile\n\nThe manifest bootstraps a fresh machine; the **lockfile** is what guarantees\nidentical bytes thereafter. Commit `qvr.lock` together with `qvr.toml` (and the\nmanifest, if you keep one) to version control. `qvr.toml` carries the declared\nintent and the project's default agent targets so routing travels with the repo;\n`qvr.lock` is self-sufficient, so `qvr sync` on a fresh clone rebuilds the whole\nset from the lock alone — CI never needs `qvr.toml`:\n\n```\ngit add qvr.toml qvr.lock skills.lock.txt\ngit commit -m \"Pin agent skill set\"\n```\n\n### 4. Assert reproducibility in CI\n\nUse the read-only assertions so CI fails loudly on drift or a stale lock — never\nsilently reconciles:\n\n```\nqvr sync --check       # read-only: exit non-zero if project is out of sync; writes nothing\nqvr sync --locked      # restore worktrees but make NO lock changes; fail if lock is stale or drifted\nqvr sync --frozen      # restore strictly from the lock as-is; never re-resolve or rewrite it\n```\n\nA typical CI step:\n\n```\nqvr sync --locked && qvr list\n```\n\n`--check` is the lightest gate (does not even touch the filesystem). `--locked`\nadditionally restores worktrees so the rest of the job can run against real\nskills, while still failing if a sync *would* have to modify `qvr.lock`.\n\n## Gotchas\n\n- **Pin on the export side, not the import side.** `export --frozen` bakes a\n  `--commit=\u003Csha>` into each manifest line; a plain `qvr import` of that manifest\n  reproduces exact bytes. A *ref-only* manifest (no `--frozen` export) re-resolves\n  to the ref tip on import — so the pin you keep or lose is decided at export.\n  Don't reach for `import --frozen` to \"keep the pin\": it's a re-import drift-guard\n  that needs an existing `qvr.lock` and fails on a from-scratch machine.\n- **`--allow-drift` defeats the purpose.** It downgrades subtreeHash drift to a\n  warning; it's a rare local-debug escape hatch and must never appear in CI.\n- **Edit\u002Flink skills don't travel.** They live in the project tree. Export them\n  with `--include-local` only as documentation; the recipient must re-create them\n  (see `fork-and-publish-skill`).\n- **Manifest ≠ lockfile.** The manifest is for bootstrapping a new environment;\n  the lockfile is the reproducibility guarantee. Keep both in sync by re-exporting\n  after you change the set.\n\n## Troubleshooting\n\n- *CI passes locally but fails in the pipeline* — the lock is likely stale or an\n  entry drifted. Reproduce with `qvr sync --locked`; inspect with\n  `qvr lock verify` and `qvr status` (see `verify-skill-supply-chain`).\n- *Import installs a different commit than expected* — you imported a ref-only\n  manifest. Re-export with `--frozen` (which embeds `--commit=` pins) and import\n  it plainly; the pins are honored without an import-side `--frozen` flag.\n- *`--frozen requires a readable lock file`* — you passed `import --frozen` on a\n  fresh machine with no `qvr.lock`. Drop `--frozen`: a plain `import` of a frozen\n  (commit-pinned) manifest is already byte-exact.\n- *A skill silently missing after import* — it was an `edit`\u002F`link` (local) skill,\n  skipped by default. Re-create it in the project.\n",{"name":5,"metadata":49,"description":52},{"author":50,"version":51},"quiver-playground","1.0.0","Reproduces an exact agent-skill set across machines, teammates, and CI using qvr's portable manifest and lockfile guarantees. Use when a user wants to share, pin, replicate, or CI-gate their qvr skills — e.g. \"export my skills\", \"import this skill manifest\", \"pin everything to exact commits\", \"make skills reproducible\", \"fail CI if skills drift\", or \"onboard a teammate to the same skills\". Covers qvr export\u002Fimport, --frozen pinning, and the sync --locked \u002F sync --check CI assertions.\n","main","71783910729031afe6ad1d640728b1534ee4c198","skills\u002Freproduce-skill-env",0,"https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr","https:\u002F\u002Fgithub.com\u002Ftry-agora","sdlc tools for multiplayer coding","2026-07-01 02:12:06",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add try-agora\u002Fqvr --skill reproduce-skill-env",{"tool":67,"command":68},"bunx","bunx skills add try-agora\u002Fqvr --skill reproduce-skill-env",{"tool":70,"command":71},"pnpm","pnpm dlx skills add try-agora\u002Fqvr --skill reproduce-skill-env","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Fskills\u002Freproduce-skill-env\u002FSKILL.md",true,[],[76,103,116,134,157,175],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":86,"publishedAt":44},"01M71CAMTR0ADSZQ9CYFW363D8","valid-skill","A valid test skill for unit testing. Use when testing the quiver validation pipeline to ensure correct skills pass all checks.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fvalid-skill\u002FSKILL.md",[82,85],{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[87,88,89,27,90,91,92,93,94,95,96,97,40,28,98,99,100,101,102],"valid skill","valid","org","unit testing","git","grep","validation","read","test","Test Skill","Bash","testing","correct","pipeline","for","unit",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":111,"publishedAt":44},"01M71CAK6B219E10ZPYX0C4JK8","example-skill","An example skill for testing registry discovery.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fsample-registry\u002Fskills\u002Fexample-skill\u002FSKILL.md",[109,110],{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,101,95,114,89,115,98],"example skill","example","discovery","registry",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":44},"01M71CAHR5A0MTDYXHDDE19TJR","malicious-skill-unicode","Fixture for the unicode check. Contains hidden zero-width and bidirectional-override characters that the scanner must flag.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-unicode\u002FSKILL.md",[122],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[124,125,126,127,128,129,130,101,131,132,133],"malicious skill unicode","malicious","malicious skill","Unicode","hidden","scanner","check","ZeRO","fixture","characters",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":44},"01M71CAFJPYFFX70KKPBM9TFT8","malicious-skill-tool-misuse","Fixture exercising the tool-misuse rule family (TM1a shell=True, TM1b rm -rf root, TM1c --no-verify, TM1d chmod 777, TM3 verify=False) and SC2 curl pipe shell. Used by the scanner integration test as the canonical \"tool misuse\" sample.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-tool-misuse\u002FSKILL.md",[140],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,143,125,126,144,145,146,147,148,149,150,151,95,129,152,153,154,155,156,132],"tool","malicious skill tool misuse","canonical","family","shell","rm","verify","curl","pipe","sample","false","integration","true","integration test","as",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":44},"01M71CAD9MG9F0RDRQAPH9BD08","malicious-skill-supply-chain","Fixture for the supply-chain check. Ships a requirements.txt pinning a known-vulnerable pyyaml (CVE-2020-14343), an unpinned requirement, an abandoned package, and a typosquatted name. Drives SC1\u002FSC4\u002FSC5\u002FSC6 simultaneously.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-supply-chain\u002FSKILL.md",[163],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[165,125,166,126,167,168,101,169,132,170,171,172,130,173,174],"supply chain","chain","supply","malicious skill supply chain","cve","unpinned","supply-chain","name","requirements","package",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":182,"publishedAt":44},"01M71CAARKXHD0HA2N67TFBJ8B","malicious-skill-signatures","Fixture for the YARA-lite signature engine. Carries a small bash reverse-shell script (YR1_bash_reverse_shell) and a minimal PHP eval webshell (YR2_php_eval_shell) so the integration test can assert both critical signature matches in a single scan.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-signatures\u002FSKILL.md",[181],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[126,183,125,184,97,185,186,95,187,188,189,190,191,192,193,155,194,101,195,132],"malicious skill signatures","signatures","yara","reverse-shell","engine","webshell","can","critical","single","eval","minimal","scan","reverse"]