Security

Threat model

Skills are instructions, and instructions can be adversarial (prompt injection). A downloaded SKILL.md is not trusted until it passes the quarantine pipeline in SKILL.md: download to a quarantine dir, scan with SkillSpector, show the human the verdict, and install only after explicit approval.

scripts/ in any skill is code. It is never executed without human review, regardless of scan results.

Reporting a vulnerability

Open an issue with the security label, or contact the maintainer directly. Do not include live secrets in the report.