[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CA8P0Y1TSY0YAXQ2AA6FX":3,"skill-same:01M71CA8P0Y1TSY0YAXQ2AA6FX":69},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":6,"ownerDescription":47,"updatedAt":48,"install":49,"resources":62},"01M71CA8P0Y1TSY0YAXQ2AA6FX","malicious-skill-secrets",null,"Fixture for the secrets check. Contains hardcoded credential-shaped strings that the scanner must flag as critical findings.","try-agora\u002Fqvr","try-agora","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F291123208?v=4","01M71C8JCBG20FR84774RF053Q","AGORA","01M71C8JCYSVRHPDR1EV8T0WN8",26,"MIT","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-secrets\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35],"malicious","secrets","malicious skill","malicious skill secrets","check","credential","scanner","fixture","as","critical","strings","for","2026-11-10 10:12:30",false,"---\nname: malicious-skill-secrets\ndescription: Fixture for the secrets check. Contains hardcoded credential-shaped strings that the scanner must flag as critical findings.\n---\n\n# Skill (with leaked credentials)\n\nUse the deployment account to push artifacts.\n\n```\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\ngithub_token=ghp_abcdef1234567890ABCDEFGHIJKLMNOPqrst\n```\n\nThe JWT below is the service account bearer:\n\neyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c\n","# Skill (with leaked credentials)\n\nUse the deployment account to push artifacts.\n\n```\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\ngithub_token=ghp_abcdef1234567890ABCDEFGHIJKLMNOPqrst\n```\n\nThe JWT below is the service account bearer:\n\neyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c\n",{"name":5,"description":7},"main","71783910729031afe6ad1d640728b1534ee4c198","testdata\u002Fmalicious-skill-secrets",0,"https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr","https:\u002F\u002Fgithub.com\u002Ftry-agora","sdlc tools for multiplayer coding","2026-07-01 02:12:06",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add try-agora\u002Fqvr --skill malicious-skill-secrets",{"tool":55,"command":56},"bunx","bunx skills add try-agora\u002Fqvr --skill malicious-skill-secrets",{"tool":58,"command":59},"pnpm","pnpm dlx skills add try-agora\u002Fqvr --skill malicious-skill-secrets","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-secrets\u002FSKILL.md",true,[63],{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"scripts\u002Fleak.sh","SCRIPT","脚本",269,"https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-secrets\u002Fscripts\u002Fleak.sh",[70,99,112,125,147,165],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":80,"publishedAt":36},"01M71CAMTR0ADSZQ9CYFW363D8","valid-skill","A valid test skill for unit testing. Use when testing the quiver validation pipeline to ensure correct skills pass all checks.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fvalid-skill\u002FSKILL.md",[76,79],{"categoryNo":77,"categoryName":78,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,35,98],"valid skill","valid","org","use","unit testing","git","grep","validation","read","test","Test Skill","Bash","when","quiver","testing","correct","pipeline","unit",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":107,"publishedAt":36},"01M71CAK6B219E10ZPYX0C4JK8","example-skill","An example skill for testing registry discovery.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fsample-registry\u002Fskills\u002Fexample-skill\u002FSKILL.md",[105,106],{"categoryNo":77,"categoryName":78,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[108,109,35,90,110,83,111,95],"example skill","example","discovery","registry",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":119,"publishedAt":36},"01M71CAHR5A0MTDYXHDDE19TJR","malicious-skill-unicode","Fixture for the unicode check. Contains hidden zero-width and bidirectional-override characters that the scanner must flag.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-unicode\u002FSKILL.md",[118],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[120,24,26,121,122,30,28,35,123,31,124],"malicious skill unicode","Unicode","hidden","ZeRO","characters",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":36},"01M71CAFJPYFFX70KKPBM9TFT8","malicious-skill-tool-misuse","Fixture exercising the tool-misuse rule family (TM1a shell=True, TM1b rm -rf root, TM1c --no-verify, TM1d chmod 777, TM3 verify=False) and SC2 curl pipe shell. Used by the scanner integration test as the canonical \"tool misuse\" sample.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-tool-misuse\u002FSKILL.md",[131],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[133,134,24,26,135,136,137,138,139,140,141,142,90,30,143,144,145,146,32,31],"tool","malicious skill tool misuse","canonical","family","shell","rm","verify","curl","pipe","sample","false","integration","true","integration test",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":154,"publishedAt":36},"01M71CAD9MG9F0RDRQAPH9BD08","malicious-skill-supply-chain","Fixture for the supply-chain check. Ships a requirements.txt pinning a known-vulnerable pyyaml (CVE-2020-14343), an unpinned requirement, an abandoned package, and a typosquatted name. Drives SC1\u002FSC4\u002FSC5\u002FSC6 simultaneously.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-supply-chain\u002FSKILL.md",[153],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[155,24,156,26,157,158,35,159,31,160,161,162,28,163,164],"supply chain","chain","supply","malicious skill supply chain","cve","unpinned","supply-chain","name","requirements","package",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":36},"01M71CAARKXHD0HA2N67TFBJ8B","malicious-skill-signatures","Fixture for the YARA-lite signature engine. Carries a small bash reverse-shell script (YR1_bash_reverse_shell) and a minimal PHP eval webshell (YR2_php_eval_shell) so the integration test can assert both critical signature matches in a single scan.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-signatures\u002FSKILL.md",[171],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[26,173,24,174,92,175,176,90,177,178,179,33,180,181,182,146,183,35,184,31],"malicious skill signatures","signatures","yara","reverse-shell","engine","webshell","can","single","eval","minimal","scan","reverse"]