[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71C9BT51MQ95HSSFAK4Z2N2":3,"skill-same:01M71C9BT51MQ95HSSFAK4Z2N2":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M71C9BT51MQ95HSSFAK4Z2N2","verify-skill-supply-chain",null,"Vets and continuously verifies the integrity and provenance of agent skills installed with qvr. Use when a user cares about skill security, trust, signing, tampering, or supply-chain integrity — e.g. \"scan this skill for problems\", \"is this skill safe\", \"verify the skill hasn't drifted\", \"who is allowed to author this registry's skills\", \"check the signature\", or \"gate CI on skill integrity\". Covers qvr scan, lock verify (--fail-on, --repair), trust pin\u002Fverify, and provenance.","try-agora\u002Fqvr","try-agora","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F291123208?v=4","01M71C8JCBG20FR84774RF053Q","AGORA","01M71C8JCYSVRHPDR1EV8T0WN8",26,"MIT","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Fskills\u002Fverify-skill-supply-chain\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"supply","verify skill supply chain","supply chain","verify","verify skill","chain","scan","for","repair","trust","supply-chain","security","integrity","registry","playground","safe","lock","when","ci","skill security","2026-11-10 10:12:30",false,"---\nname: verify-skill-supply-chain\ndescription: >\n  Vets and continuously verifies the integrity and provenance of agent skills\n  installed with qvr. Use when a user cares about skill security, trust, signing,\n  tampering, or supply-chain integrity — e.g. \"scan this skill for problems\",\n  \"is this skill safe\", \"verify the skill hasn't drifted\", \"who is allowed to\n  author this registry's skills\", \"check the signature\", or \"gate CI on skill\n  integrity\". Covers qvr scan, lock verify (--fail-on, --repair), trust\n  pin\u002Fverify, and provenance.\nmetadata:\n  author: quiver-playground\n  version: \"1.0.0\"\n---\n\n# Verify the skill supply chain with qvr\n\nA skill is code-adjacent: it ships instructions and files an agent will act on.\nqvr gives four independent checks — a static **scan** of content, a content\n**hash drift** check against the lockfile, an author **trust** policy per\nregistry, and **provenance** (source, pinning, signature). This skill combines\nthem into a vetting pass you can run at install time and re-run in CI.\n\n## When to use this\n\n- Before trusting a newly added or third-party skill.\n- To prove an installed skill hasn't been altered since it was pinned.\n- To enforce *who* is allowed to author skills in a given registry.\n- To gate CI on integrity (fail on drift or unverified entries).\n\n## The four checks\n\n### 1. Scan content (static analysis)\n\n`qvr scan` reads every file as a string — it never executes anything — and reports\ncategories such as prompt-injection patterns, leaked credentials, hidden\u002Fbidi\nunicode, and risky permissions. The exit code is controlled by `--fail-on`\n(default `error`).\n\n```\nqvr scan my-skill                                   # installed name or a path\nqvr scan .\u002Fskills\u002Fmy-skill --fail-on critical       # only fail on the worst\nqvr scan my-skill --severity warning                # show warnings and up\nqvr scan my-skill --against origin\u002Fmain             # only findings new vs a ref\nqvr scan my-skill --format sarif > scan.sarif       # machine-readable for CI (scan has no -o; redirect)\n```\n\nInstall-time scanning is on by default (`security.scan_on_install`); `qvr add\n--no-scan` opts out for a single install (prefer not to).\n\n### 2. Verify content integrity (hash drift)\n\n`qvr lock verify` recomputes each entry's subtree hash from disk and compares it\nto the recorded value, reporting `ok`, `drift`, `unverified` (no recorded hash),\n`missing` (worktree gone), `link`, or `failed`. It exits non-zero on drift by\ndefault so CI can gate:\n\n```\nqvr lock verify                          # default: drift\u002Fmissing\u002Ffailed are fatal\nqvr lock verify --fail-on unverified     # also fail when an entry has no recorded hash\nqvr lock verify --fail-on none           # report only (old behavior, exit 0)\n```\n\nTwo repair\u002Fmaintenance paths:\n\n```\nqvr lock verify --repair                 # rewrite Verification blocks from current disk\nqvr lock upgrade                          # backfill missing Verification blocks\n```\n\nOnly `--repair` when you **trust the current worktree** — it re-pins to whatever\nis on disk, drift and all.\n\n### 3. Enforce author trust policy\n\nPin which commit authors a registry is allowed to ship from, then verify\ninstalled skills against that policy:\n\n```\nqvr trust list                                       # trusted authors by registry\nqvr trust pin \u003Corg>\u002F\u003Crepo> \"Trusted Author\"          # allow an author for one registry\nqvr trust verify                                     # check installs vs policy\nqvr trust verify --all                               # project + global\nqvr trust unpin \u003Corg>\u002F\u003Crepo>                          # remove the registry's pins\n```\n\nUse the full `\u003Corg>\u002F\u003Crepo>` registry name.\n\n### 4. Inspect provenance and signatures\n\n```\nqvr provenance my-skill        # source, subdir, pinned commit\u002Ftree, scan status, signature\nqvr provenance my-skill --all  # search project + global\n```\n\n`provenance` is honest about limits: a `verified` signature means git's\n`verify-tag` \u002F `verify-commit` was satisfied — it does **not** by itself mean the\nauthor is trusted (that's what `trust` is for). An unsigned skill installs unless\n`security.require_signed` is enabled; an *invalid* signature is refused at install\ntime.\n\n## A vetting pass (recommended order)\n\n1. `qvr scan my-skill --fail-on error` — reject obviously hostile content.\n2. `qvr provenance my-skill` — confirm source, pinning, and signature status.\n3. `qvr trust verify` — confirm the author is allowed for that registry.\n4. `qvr lock verify` — confirm nothing has drifted since it was pinned.\n\nIn CI, chain the gating forms:\n\n```\nqvr scan --fail-on error .\u002Fskills\u002Fmy-skill && qvr lock verify --fail-on drift\n```\n\n## Gotchas\n\n- **Scanner reports, never executes.** The executable bit is reported, not\n  honoured. A clean scan is necessary, not sufficient — still read what a skill\n  does.\n- **`--repair` can launder drift.** It re-pins to current disk; use it only after\n  you've confirmed the worktree is the intended content.\n- **Signed ≠ trusted.** Pair `provenance` (signature valid?) with `trust verify`\n  (author allowed?). They answer different questions.\n- **`--no-scan` and `--allow-drift` are escape hatches**, not defaults — keep them\n  out of CI.\n- **`--fail-on none` hides problems.** It restores the old report-only behavior;\n  fine for a dashboard, wrong for a gate.\n\n## Troubleshooting\n\n- *`lock verify` reports `unverified`* — the entry predates Verification blocks.\n  Run `qvr lock upgrade` to backfill, then re-verify.\n- *Drift you didn't cause* — the worktree was edited (maybe an `edit` eject) or\n  the cache was touched. Inspect with `qvr diff \u003Cskill>` and `qvr status`; restore\n  with `qvr sync` (without `--allow-drift`).\n- *`trust verify` fails after a fork* — the fork registers a new `\u003Corg>\u002F\u003Crepo>`;\n  pin the intended author for that registry name.\n- *Signature shows `none`* — upstream didn't sign the tag\u002Fcommit. Decide via\n  policy (`security.require_signed`) rather than ad hoc.\n","# Verify the skill supply chain with qvr\n\nA skill is code-adjacent: it ships instructions and files an agent will act on.\nqvr gives four independent checks — a static **scan** of content, a content\n**hash drift** check against the lockfile, an author **trust** policy per\nregistry, and **provenance** (source, pinning, signature). This skill combines\nthem into a vetting pass you can run at install time and re-run in CI.\n\n## When to use this\n\n- Before trusting a newly added or third-party skill.\n- To prove an installed skill hasn't been altered since it was pinned.\n- To enforce *who* is allowed to author skills in a given registry.\n- To gate CI on integrity (fail on drift or unverified entries).\n\n## The four checks\n\n### 1. Scan content (static analysis)\n\n`qvr scan` reads every file as a string — it never executes anything — and reports\ncategories such as prompt-injection patterns, leaked credentials, hidden\u002Fbidi\nunicode, and risky permissions. The exit code is controlled by `--fail-on`\n(default `error`).\n\n```\nqvr scan my-skill                                   # installed name or a path\nqvr scan .\u002Fskills\u002Fmy-skill --fail-on critical       # only fail on the worst\nqvr scan my-skill --severity warning                # show warnings and up\nqvr scan my-skill --against origin\u002Fmain             # only findings new vs a ref\nqvr scan my-skill --format sarif > scan.sarif       # machine-readable for CI (scan has no -o; redirect)\n```\n\nInstall-time scanning is on by default (`security.scan_on_install`); `qvr add\n--no-scan` opts out for a single install (prefer not to).\n\n### 2. Verify content integrity (hash drift)\n\n`qvr lock verify` recomputes each entry's subtree hash from disk and compares it\nto the recorded value, reporting `ok`, `drift`, `unverified` (no recorded hash),\n`missing` (worktree gone), `link`, or `failed`. It exits non-zero on drift by\ndefault so CI can gate:\n\n```\nqvr lock verify                          # default: drift\u002Fmissing\u002Ffailed are fatal\nqvr lock verify --fail-on unverified     # also fail when an entry has no recorded hash\nqvr lock verify --fail-on none           # report only (old behavior, exit 0)\n```\n\nTwo repair\u002Fmaintenance paths:\n\n```\nqvr lock verify --repair                 # rewrite Verification blocks from current disk\nqvr lock upgrade                          # backfill missing Verification blocks\n```\n\nOnly `--repair` when you **trust the current worktree** — it re-pins to whatever\nis on disk, drift and all.\n\n### 3. Enforce author trust policy\n\nPin which commit authors a registry is allowed to ship from, then verify\ninstalled skills against that policy:\n\n```\nqvr trust list                                       # trusted authors by registry\nqvr trust pin \u003Corg>\u002F\u003Crepo> \"Trusted Author\"          # allow an author for one registry\nqvr trust verify                                     # check installs vs policy\nqvr trust verify --all                               # project + global\nqvr trust unpin \u003Corg>\u002F\u003Crepo>                          # remove the registry's pins\n```\n\nUse the full `\u003Corg>\u002F\u003Crepo>` registry name.\n\n### 4. Inspect provenance and signatures\n\n```\nqvr provenance my-skill        # source, subdir, pinned commit\u002Ftree, scan status, signature\nqvr provenance my-skill --all  # search project + global\n```\n\n`provenance` is honest about limits: a `verified` signature means git's\n`verify-tag` \u002F `verify-commit` was satisfied — it does **not** by itself mean the\nauthor is trusted (that's what `trust` is for). An unsigned skill installs unless\n`security.require_signed` is enabled; an *invalid* signature is refused at install\ntime.\n\n## A vetting pass (recommended order)\n\n1. `qvr scan my-skill --fail-on error` — reject obviously hostile content.\n2. `qvr provenance my-skill` — confirm source, pinning, and signature status.\n3. `qvr trust verify` — confirm the author is allowed for that registry.\n4. `qvr lock verify` — confirm nothing has drifted since it was pinned.\n\nIn CI, chain the gating forms:\n\n```\nqvr scan --fail-on error .\u002Fskills\u002Fmy-skill && qvr lock verify --fail-on drift\n```\n\n## Gotchas\n\n- **Scanner reports, never executes.** The executable bit is reported, not\n  honoured. A clean scan is necessary, not sufficient — still read what a skill\n  does.\n- **`--repair` can launder drift.** It re-pins to current disk; use it only after\n  you've confirmed the worktree is the intended content.\n- **Signed ≠ trusted.** Pair `provenance` (signature valid?) with `trust verify`\n  (author allowed?). They answer different questions.\n- **`--no-scan` and `--allow-drift` are escape hatches**, not defaults — keep them\n  out of CI.\n- **`--fail-on none` hides problems.** It restores the old report-only behavior;\n  fine for a dashboard, wrong for a gate.\n\n## Troubleshooting\n\n- *`lock verify` reports `unverified`* — the entry predates Verification blocks.\n  Run `qvr lock upgrade` to backfill, then re-verify.\n- *Drift you didn't cause* — the worktree was edited (maybe an `edit` eject) or\n  the cache was touched. Inspect with `qvr diff \u003Cskill>` and `qvr status`; restore\n  with `qvr sync` (without `--allow-drift`).\n- *`trust verify` fails after a fork* — the fork registers a new `\u003Corg>\u002F\u003Crepo>`;\n  pin the intended author for that registry name.\n- *Signature shows `none`* — upstream didn't sign the tag\u002Fcommit. Decide via\n  policy (`security.require_signed`) rather than ad hoc.\n",{"name":5,"metadata":49,"description":52},{"author":50,"version":51},"quiver-playground","1.0.0","Vets and continuously verifies the integrity and provenance of agent skills installed with qvr. Use when a user cares about skill security, trust, signing, tampering, or supply-chain integrity — e.g. \"scan this skill for problems\", \"is this skill safe\", \"verify the skill hasn't drifted\", \"who is allowed to author this registry's skills\", \"check the signature\", or \"gate CI on skill integrity\". Covers qvr scan, lock verify (--fail-on, --repair), trust pin\u002Fverify, and provenance.\n","main","71783910729031afe6ad1d640728b1534ee4c198","skills\u002Fverify-skill-supply-chain",0,"https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr","https:\u002F\u002Fgithub.com\u002Ftry-agora","sdlc tools for multiplayer coding","2026-07-01 02:12:06",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add try-agora\u002Fqvr --skill verify-skill-supply-chain",{"tool":67,"command":68},"bunx","bunx skills add try-agora\u002Fqvr --skill verify-skill-supply-chain",{"tool":70,"command":71},"pnpm","pnpm dlx skills add try-agora\u002Fqvr --skill verify-skill-supply-chain","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Fskills\u002Fverify-skill-supply-chain\u002FSKILL.md",true,[],[76,104,116,134,156,170],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":86,"publishedAt":44},"01M71CAMTR0ADSZQ9CYFW363D8","valid-skill","A valid test skill for unit testing. Use when testing the quiver validation pipeline to ensure correct skills pass all checks.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fvalid-skill\u002FSKILL.md",[82,85],{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[87,88,89,90,91,92,93,94,95,96,97,98,41,99,100,101,102,31,103],"valid skill","valid","org","use","unit testing","git","grep","validation","read","test","Test Skill","Bash","quiver","testing","correct","pipeline","unit",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":112,"publishedAt":44},"01M71CAK6B219E10ZPYX0C4JK8","example-skill","An example skill for testing registry discovery.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fsample-registry\u002Fskills\u002Fexample-skill\u002FSKILL.md",[110,111],{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,31,96,115,89,37,100],"example skill","example","discovery",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":123,"publishedAt":44},"01M71CAHR5A0MTDYXHDDE19TJR","malicious-skill-unicode","Fixture for the unicode check. Contains hidden zero-width and bidirectional-override characters that the scanner must flag.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-unicode\u002FSKILL.md",[122],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[124,125,126,127,128,129,130,31,131,132,133],"malicious skill unicode","malicious","malicious skill","Unicode","hidden","scanner","check","ZeRO","fixture","characters",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":44},"01M71CAFJPYFFX70KKPBM9TFT8","malicious-skill-tool-misuse","Fixture exercising the tool-misuse rule family (TM1a shell=True, TM1b rm -rf root, TM1c --no-verify, TM1d chmod 777, TM3 verify=False) and SC2 curl pipe shell. Used by the scanner integration test as the canonical \"tool misuse\" sample.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-tool-misuse\u002FSKILL.md",[140],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[142,143,125,126,144,145,146,147,27,148,149,150,96,129,151,152,153,154,155,132],"tool","malicious skill tool misuse","canonical","family","shell","rm","curl","pipe","sample","false","integration","true","integration test","as",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":44},"01M71CAD9MG9F0RDRQAPH9BD08","malicious-skill-supply-chain","Fixture for the supply-chain check. Ships a requirements.txt pinning a known-vulnerable pyyaml (CVE-2020-14343), an unpinned requirement, an abandoned package, and a typosquatted name. Drives SC1\u002FSC4\u002FSC5\u002FSC6 simultaneously.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-supply-chain\u002FSKILL.md",[162],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[26,125,29,126,24,164,31,165,132,166,34,167,130,168,169],"malicious skill supply chain","cve","unpinned","name","requirements","package",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":177,"publishedAt":44},"01M71CAARKXHD0HA2N67TFBJ8B","malicious-skill-signatures","Fixture for the YARA-lite signature engine. Carries a small bash reverse-shell script (YR1_bash_reverse_shell) and a minimal PHP eval webshell (YR2_php_eval_shell) so the integration test can assert both critical signature matches in a single scan.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-signatures\u002FSKILL.md",[176],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[126,178,125,179,98,180,181,96,182,183,184,185,186,187,188,154,30,31,189,132],"malicious skill signatures","signatures","yara","reverse-shell","engine","webshell","can","critical","single","eval","minimal","reverse"]