Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add astra-sh/qvr --skill reproduce-skill-envgit clone --depth 1 https://github.com/astra-sh/qvrWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/astra-sh/qvr/reproduce-skill-env)<a href="https://agentmods.dev/skills/astra-sh/qvr/reproduce-skill-env"><img src="https://agentmods.dev/badge/skills/astra-sh/qvr/reproduce-skill-env/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/astra-sh/qvr/reproduce-skill-env"><img src="https://agentmods.dev/badge/skills/astra-sh/qvr/reproduce-skill-env.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00123 | $0.01710 |
| Opus 5 | $0.00062 | $0.00855 |
| Sonnet 5 | $0.00025 | $0.00342 |
| Haiku 4.5 | $0.00012 | $0.00171 |
Grade A, and why
reproduce-skill-env scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 146 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reproduce a skill environment with qvr
qvr separates intent from bytes: qvr.lock pins each skill to a commit and
a subtreeHash, so the exact content can be restored even if upstream refs move.
On top of that, qvr export emits a small, human-readable manifest that a
teammate (or a CI job) can qvr import to rebuild the same set from scratch —
without any pre-existing registry configuration. This skill covers sharing a set,
pinning it hard, and asserting reproducibility in CI.
When to use this
- The user wants to share their skill set with a teammate or another machine.
- They want byte-for-byte reproducibility (pin to exact commits, not floating refs).
- They want CI to fail if the checked-out skills don't match the lockfile.
For first-time discovery/install of individual skills, use onboard-skills
instead.
Key concepts
- Manifest (export) — a 3-column text file: repo URL, skill name, version.
Portable and reviewable. By default it records the ref;
--frozenrecords the exact pinned commit. - Lockfile (
qvr.lock) — the authoritative TOML v5 record with commit + subtreeHash. Commit it to version control. mode: edit/mode: linkskills live in the project filesystem and are not portable across projects; they're skipped from exports by default.
Workflow
1. Export the current set
qvr export > skills.txt # ref-only (floating)
qvr export --frozen > skills.lock.txt # pin to recorded commits
qvr export --output-file=skills.txt --include-aliases
qvr export --include-local # emit edit/link skills as commented docs
Choose --frozen when you want the recipient to get the exact same bytes; omit
it when you want them to track whatever the ref currently points at.
2. Import on another machine / for a teammate
qvr import registers each source repo if needed, then installs each skill via
the same code path as qvr add:
qvr import skills.txt # register sources + install each
qvr import skills.lock.txt # frozen manifest: per-line --commit= pins are honored — plain import, no qvr.lock needed
qvr import --target=claude,cursor skills.txt # install into specific targets
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 146 lines · 123 tokens per session scan A acc44c4b48c6
reproduce-skill-env is a skill published in the GitHub repository astra-sh/qvr (23 stars, last pushed 2mo ago), licensed MIT. It adds 123 tokens to every session and 1,710 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hyperframes-best-practices
Production-grade HyperFrames workflow for turning a raw screencast or talking-head recording into a polished product video. Covers the smart-cut pipeline (transcript + silence + scene detection with word-boundary buffers), surgical audio scrubbing (concat-filter rendering, adeclick, targeted transient mute), the…
figma-connect
Figma-to-code bridge combining Figma MCP server tools with the Code Connect CLI for end-to-end design implementation workflows. Use this skill when implementing UI components from Figma design URLs, publishing Code Connect mappings to Figma Dev Mode, extracting design tokens from Figma variables, setting up Figma Code…
blotato
Blotato social-media publishing and scheduling platform — REST API + MCP server. Publish and schedule posts across X/Twitter, TikTok, Instagram, LinkedIn, YouTube, Facebook, Threads, Pinterest, and more from a single integration. Use this skill whenever the user wants to schedule, publish, queue, or batch-post content…
survey-passing
Find and complete paid expert surveys from expert network platforms (Arbolus, Guidepoint, GLG, AlphaSights, Techsponential) using the user's real professional background. Automates the mechanical form-filling of expert consultations that pay $50-$100+. Use this skill whenever the user mentions surveys, canopy, expert…
frontend-design
Create distinctive, production-grade frontend interfaces with visual verification. Use this skill when the user asks to build web components, pages, landing pages, dashboards, React/Vue/Svelte components, HTML/CSS layouts, or any web UI that needs to look polished. Also activates when styling, beautifying…
skill-builder
Meta-skill for creating new skills from natural language. Trigger phrases: "new skill", "create a skill", "build a skill", "make a skill", "generate a skill", "author a skill", "skill builder".