verify-skill-supply-chain

Verify the skill supply chain with qvr

A skill is code-adjacent: it ships instructions and files an agent will act on. qvr gives four independent checks — a static scan of content, a content hash drift check against the lockfile, an author trust policy per registry, and provenance (source, pinning, signature). This skill combines them into a vetting pass you can run at install time and re-run in CI.

When to use this

• Before trusting a newly added or third-party skill.
• To prove an installed skill hasn't been altered since it was pinned.
• To enforce who is allowed to author skills in a given registry.
• To gate CI on integrity (fail on drift or unverified entries).

The four checks

1. Scan content (static analysis)

qvr scan reads every file as a string — it never executes anything — and reports categories such as prompt-injection patterns, leaked credentials, hidden/bidi unicode, and risky permissions. The exit code is controlled by --fail-on (default error).

qvr scan my-skill                                   # installed name or a path
qvr scan ./skills/my-skill --fail-on critical       # only fail on the worst
qvr scan my-skill --severity warning                # show warnings and up
qvr scan my-skill --against origin/main             # only findings new vs a ref
qvr scan my-skill --format sarif > scan.sarif       # machine-readable for CI (scan has no -o; redirect)

Install-time scanning is on by default (security.scan_on_install); qvr add --no-scan opts out for a single install (prefer not to).

2. Verify content integrity (hash drift)

qvr lock verify recomputes each entry's subtree hash from disk and compares it to the recorded value, reporting ok, drift, unverified (no recorded hash), missing (worktree gone), link, or failed. It exits non-zero on drift by default so CI can gate:

qvr lock verify                          # default: drift/missing/failed are fatal
qvr lock verify --fail-on unverified     # also fail when an entry has no recorded hash
qvr lock verify --fail-on none           # report only (old behavior, exit 0)