[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CAD9MG9F0RDRQAPH9BD08":3,"skill-same:01M71CAD9MG9F0RDRQAPH9BD08":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M71CAD9MG9F0RDRQAPH9BD08","malicious-skill-supply-chain",null,"Fixture for the supply-chain check. Ships a requirements.txt pinning a known-vulnerable pyyaml (CVE-2020-14343), an unpinned requirement, an abandoned package, and a typosquatted name. Drives SC1\u002FSC4\u002FSC5\u002FSC6 simultaneously.","try-agora\u002Fqvr","try-agora","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F291123208?v=4","01M71C8JCBG20FR84774RF053Q","AGORA","01M71C8JCYSVRHPDR1EV8T0WN8",26,"MIT","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-supply-chain\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"supply","malicious skill","chain","malicious","supply chain","malicious skill supply chain","fixture","cve","for","unpinned","package","requirements","check","name","supply-chain","2026-11-10 10:12:30",false,"---\nname: malicious-skill-supply-chain\ndescription: Fixture for the supply-chain check. Ships a requirements.txt pinning a known-vulnerable pyyaml (CVE-2020-14343), an unpinned requirement, an abandoned package, and a typosquatted name. Drives SC1\u002FSC4\u002FSC5\u002FSC6 simultaneously.\n---\n\n# Skill (supply chain)\n\nInstall with:\n\n```\npip install -r requirements.txt\n```\n","# Skill (supply chain)\n\nInstall with:\n\n```\npip install -r requirements.txt\n```\n",{"name":5,"description":7},"main","71783910729031afe6ad1d640728b1534ee4c198","testdata\u002Fmalicious-skill-supply-chain",0,"https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr","https:\u002F\u002Fgithub.com\u002Ftry-agora","sdlc tools for multiplayer coding","2026-07-01 02:12:06",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add try-agora\u002Fqvr --skill malicious-skill-supply-chain",{"tool":58,"command":59},"bunx","bunx skills add try-agora\u002Fqvr --skill malicious-skill-supply-chain",{"tool":61,"command":62},"pnpm","pnpm dlx skills add try-agora\u002Fqvr --skill malicious-skill-supply-chain","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-supply-chain\u002FSKILL.md",true,[66],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"requirements.txt","REFERENCE","参考文档",130,"https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-supply-chain\u002Frequirements.txt",[73,102,115,129,152,173],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":83,"publishedAt":39},"01M71CAMTR0ADSZQ9CYFW363D8","valid-skill","A valid test skill for unit testing. Use when testing the quiver validation pipeline to ensure correct skills pass all checks.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fvalid-skill\u002FSKILL.md",[79,82],{"categoryNo":80,"categoryName":81,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,32,99,100,101],"valid","valid skill","validation","grep","git","unit testing","org","unit","Bash","when","use","quiver","testing","correct","pipeline","read","Test Skill","test",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":110,"publishedAt":39},"01M71CAK6B219E10ZPYX0C4JK8","example-skill","An example skill for testing registry discovery.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fsample-registry\u002Fskills\u002Fexample-skill\u002FSKILL.md",[108,109],{"categoryNo":80,"categoryName":81,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[111,112,101,90,113,96,114,32],"example","example skill","registry","discovery",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":39},"01M71CAHR5A0MTDYXHDDE19TJR","malicious-skill-unicode","Fixture for the unicode check. Contains hidden zero-width and bidirectional-override characters that the scanner must flag.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-unicode\u002FSKILL.md",[121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[123,25,27,124,125,126,36,32,127,30,128],"Unicode","malicious skill unicode","hidden","scanner","ZeRO","characters",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":39},"01M71CAFJPYFFX70KKPBM9TFT8","malicious-skill-tool-misuse","Fixture exercising the tool-misuse rule family (TM1a shell=True, TM1b rm -rf root, TM1c --no-verify, TM1d chmod 777, TM3 verify=False) and SC2 curl pipe shell. Used by the scanner integration test as the canonical \"tool misuse\" sample.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-tool-misuse\u002FSKILL.md",[135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[137,27,138,25,139,140,141,142,143,144,145,146,101,126,147,148,149,150,151,30],"malicious skill tool misuse","tool","canonical","family","shell","rm","verify","curl","pipe","sample","false","integration","true","integration test","as",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":39},"01M71CAARKXHD0HA2N67TFBJ8B","malicious-skill-signatures","Fixture for the YARA-lite signature engine. Carries a small bash reverse-shell script (YR1_bash_reverse_shell) and a minimal PHP eval webshell (YR2_php_eval_shell) so the integration test can assert both critical signature matches in a single scan.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-signatures\u002FSKILL.md",[158],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[160,161,27,25,162,163,92,164,165,166,167,150,168,32,169,30,170,171,101,172],"malicious skill signatures","signatures","reverse","can","critical","single","eval","minimal","scan","webshell","yara","reverse-shell","engine",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":180,"publishedAt":39},"01M71CA8P0Y1TSY0YAXQ2AA6FX","malicious-skill-secrets","Fixture for the secrets check. Contains hardcoded credential-shaped strings that the scanner must flag as critical findings.","https:\u002F\u002Fgithub.com\u002Ftry-agora\u002Fqvr\u002Fblob\u002Fmain\u002Ftestdata\u002Fmalicious-skill-secrets\u002FSKILL.md",[179],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[27,181,182,25,183,126,36,164,184,32,151,30],"secrets","malicious skill secrets","credential","strings"]