Install
$ agentstack add skill-astra-sh-qvr-fork-and-publish-skill ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Fork and publish a skill with qvr
qvr lets you take an installed skill, eject it into your project to edit directly, then publish the result — either back to its origin or to a brand new fork you own — cutting tagged releases as you go. After each publish the lock entry flips back to consume mode, so you can iterate: edit → publish v0.2.0 → edit → publish v0.3.0. This skill drives that loop.
When to use this
- The user wants to tweak a skill's content and keep the change.
- They want to publish a skill back upstream, or fork it to a repo they control.
- They want to cut tagged releases and iterate version by version.
For installing/discovering skills use onboard-skills; for verifying provenance of what you publish use verify-skill-supply-chain.
Prerequisites
- The skill must be installed in a project (not only
--global). Editing a
global skill in place would mutate a copy every project shares, so it's not supported. To change a global skill: qvr add into a project, edit and publish there, then re-add the published version with --global.
- A clean-ish working state helps;
publishrefuses a dirty eject dir unless you
pass --auto-commit.
Workflow
1. Eject the skill for editing
qvr edit promotes the symlinked skill into a real directory under the canonical agent target (the alphabetical-first installed target — e.g. .claude/skills// or .cursor/rules//, depending on what you installed into); any other installed target dirs become relative symlinks to it. The lock entry gains mode = 'edit'.
qvr edit my-skill
qvr edit my-skill --author "Jane Dev" --email jane@example.com # initial-commit identity
It's idempotent — running it again after the first eject is a no-op.
2. Make and review changes
Edit the files in the ejected skill directory (the canonical agent target), then review:
qvr diff my-skill # git diff in the skill worktree
qvr diff my-skill --stat
qvr status my-skill # dirty state + git ahead/behind
3a. Publish back to the original upstream
qvr publish my-skill -m "Fix edge case" --tag v1.0.1
qvr publish my-skill --dry-run -m "..." # validate and stage without pushing
qvr publish my-skill --auto-commit -m "..." # stage+commit a dirty eject dir first
3b. Fork to a new repo you own
Use --fork to retarget the push, and --migrate to rewrite the lock entry so future publishes track the fork:
qvr publish my-skill --fork https://github.com/me/my-skill.git --migrate --tag v0.1.0
--fork --migrate auto-registers the fork as a config registry named / (e.g. me/my-skill). To re-add the skill from it later, use that full name:
qvr add my-skill --registry me/my-skill
--layout controls the published repo shape: root (single-skill repo, the default for --fork) or nested (multi-skill registry under skills//, the default otherwise).
4. Iterate releases
Each publish flips the entry back to consume mode, so the loop repeats cleanly:
qvr edit my-skill
# ...changes...
qvr publish my-skill --tag v0.2.0
qvr edit my-skill
# ...changes...
qvr publish my-skill --tag v0.3.0
Consumers pick up a release with the version manager:
qvr outdated # which installs have newer upstream commits
qvr switch my-skill v0.3.0 # explicit pin
qvr switch my-skill --latest # jump to the latest semver tag
qvr pull my-skill # fast-forward the current ref (alias of switch --tip)
5. Add a new skill to a registry (greenfield path mode)
To publish a brand-new local skill directory into a multi-skill registry repo:
qvr publish ./my-new-skill --registry me/agent-skills -m "Add my-new-skill"
Gotchas
- Dirty eject dirs are refused.
publishwon't push uncommitted changes
unless you pass --auto-commit (which stages + commits first).
--migrateonly matters with--fork. Without it, the fork push is
one-off and the lock entry still tracks the original upstream.
- Registry name after a fork is the full
/, not a short alias —
qvr add … --registry, registry list, and registry update all need it.
- Clean up edit ejects before teardown. A
syncwith a drifted/ejected entry
fails asking for --allow-drift; publish or revert the eject first (or re-consume the skill) before a cache clean + sync.
- Lockfile/HEAD mismatch is refused for integrity; only override with
--allow-lockfile-heal if you understand why HEAD diverged.
Troubleshooting
- "refusing dirty working directory" — commit the eject, or pass
--auto-commit. - Second release fails to resolve the commit — make sure each iteration goes
through qvr edit again; the entry must be back in edit mode to publish.
qvr add --registrycan't find the fork — use the full/
name that --fork --migrate registered, visible in qvr registry list.
- Want to undo an eject without publishing — re-consume the skill (re-
add/
switch to a ref); confirm with qvr status and qvr sync.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: astra-sh
- Source: astra-sh/qvr
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.