spb/skills-spboucher-ai

1# Security policy23## Reporting a vulnerability45Email **contact@spboucher.ai** with the subject "Skills security". Include what you found, how to reproduce it, and the request id (`X-Request-Id`) of any relevant response. Please do not open a public issue for an unpatched vulnerability, and do not test against other people's accounts, namespaces or data.67You will get an acknowledgement, and a follow-up once the report has been assessed. This is a small project run by one maintainer; there is no bug bounty.89## Reporting a malicious or infringing package1011Use the report link on the artifact page, or `POST /api/v1/reports` (no account needed). Categories: `malware`, `secret-leak`, `license`, `impersonation`, `spam`, `broken`, `other`. If a package is actively harmful, also email the address above.1213## In scope1415- The registry service at skills.spboucher.ai: web UI, REST API (`/api/v1`), MCP endpoint (`/mcp`).16- The `skills` CLI, the SDK and the MCP server in this repository.17- Authentication, authorization, token handling, upload validation, release immutability, audit integrity.1819## Out of scope2021- The behaviour of third-party packages hosted on the registry (report those as packages, see above).22- Remote MCP endpoints that publishers list. The registry does not operate them.23- Volumetric denial of service.24- Findings that require shell access to the server.2526## What the registry checks, and what that means2728Every upload is parsed in memory and inspected statically. Nothing in a package is executed, imported or extracted on the server.2930Blocking checks (the upload is refused): unsafe paths, links and special files, size limits, forbidden files such as `.env` and private keys, manifest errors, identity mismatch, and recognisable credentials.3132Advisory checks (shown on the release page): scripts, executables and opaque binaries, network and subprocess use, download-and-execute patterns, access to local credential stores, text that tries to steer an agent, undeclared permissions. A defined subset of these holds the release in quarantine until a moderator reviews it.3334What this does **not** mean:3536- A release with status `passed` had no advisory findings from pattern matching. It has not been audited and is not thereby safe.37- A moderator approving a quarantined release has judged the flagged pattern acceptable. It is not a code review of the package.38- "Identity verified" says the operator confirmed who controls a namespace. "Source verified" says a moderator confirmed the linked repository belongs to the publisher. Neither says the code is safe.3940Read what you install. Skills are instructions and scripts that run with your privileges.4142## Guarantees the registry does make4344- A published version never changes. Content, manifest and checksum are frozen by database triggers; a fix is a new version.45- The SHA-256 on the release page is the hash of the bytes you download. Verify it yourself.46- A compromised version is revoked publicly with a reason, not silently removed.47- Publishing is attributable: every release records who published it and with which credential.4849## Handling of credentials5051API tokens are shown once and stored only as a keyed hash. If you believe a token has leaked, revoke it immediately (`skills auth token revoke`, the dashboard, or ask the operator). Never put a token in a repository, a prompt, an issue or a log.5253More detail: `docs/THREAT_MODEL.md`, `docs/PERMISSIONS.md`, and the public page `/docs/security`.54