Security policy
Reporting a vulnerability
Email contact@spboucher.ai with the subject "Skills security". Include what you found, how to reproduce it, and the request id (X-Request-Id) of any relevant response. Please do not open a public issue for an unpatched vulnerability, and do not test against other people's accounts, namespaces or data.
You will get an acknowledgement, and a follow-up once the report has been assessed. This is a small project run by one maintainer; there is no bug bounty.
Reporting a malicious or infringing package
Use the report link on the artifact page, or POST /api/v1/reports (no account needed). Categories: malware, secret-leak, license, impersonation, spam, broken, other. If a package is actively harmful, also email the address above.
In scope
- The registry service at skills.spboucher.ai: web UI, REST API (
/api/v1), MCP endpoint (/mcp). - The
skillsCLI, the SDK and the MCP server in this repository. - Authentication, authorization, token handling, upload validation, release immutability, audit integrity.
Out of scope
- The behaviour of third-party packages hosted on the registry (report those as packages, see above).
- Remote MCP endpoints that publishers list. The registry does not operate them.
- Volumetric denial of service.
- Findings that require shell access to the server.
What the registry checks, and what that means
Every upload is parsed in memory and inspected statically. Nothing in a package is executed, imported or extracted on the server.
Blocking checks (the upload is refused): unsafe paths, links and special files, size limits, forbidden files such as .env and private keys, manifest errors, identity mismatch, and recognisable credentials.
Advisory checks (shown on the release page): scripts, executables and opaque binaries, network and subprocess use, download-and-execute patterns, access to local credential stores, text that tries to steer an agent, undeclared permissions. A defined subset of these holds the release in quarantine until a moderator reviews it.
What this does not mean:
- A release with status
passedhad no advisory findings from pattern matching. It has not been audited and is not thereby safe. - A moderator approving a quarantined release has judged the flagged pattern acceptable. It is not a code review of the package.
- "Identity verified" says the operator confirmed who controls a namespace. "Source verified" says a moderator confirmed the linked repository belongs to the publisher. Neither says the code is safe.
Read what you install. Skills are instructions and scripts that run with your privileges.
Guarantees the registry does make
- A published version never changes. Content, manifest and checksum are frozen by database triggers; a fix is a new version.
- The SHA-256 on the release page is the hash of the bytes you download. Verify it yourself.
- A compromised version is revoked publicly with a reason, not silently removed.
- Publishing is attributable: every release records who published it and with which credential.
Handling of credentials
API tokens are shown once and stored only as a keyed hash. If you believe a token has leaked, revoke it immediately (skills auth token revoke, the dashboard, or ask the operator). Never put a token in a repository, a prompt, an issue or a log.
More detail: docs/THREAT_MODEL.md, docs/PERMISSIONS.md, and the public page /docs/security.