Skills Tree is a registry and developer platform. It contains Markdown skill instructions plus executable validation, API, CLI, MCP, and CI/CD components. Skill content is therefore treated as an agent-instruction supply-chain surface, not as inert documentation. However, we take security seriously for the following surfaces:

If you discover a security issue in this repository — including but not limited to:

• XSS or injection vulnerabilities in the docs/index.html viewer
• Malicious code examples embedded in skill files
• Supply-chain risks in GitHub Actions workflows
• Exposed secrets or credentials accidentally committed
• Prompt injection payloads embedded in skill descriptions
• Adversarial snippets designed to abuse the Dependency Auditor

Please do not open a public GitHub issue.

Instead, report it privately:

1. Email: Use GitHub's private vulnerability reporting
2. Response time: We aim to acknowledge within 48 hours and resolve within 7 days for critical issues
3. Credit: Responsible disclosures will be credited in the release notes

• Any vulnerability in the static GitHub Pages site (docs/)
• Malicious or misleading code examples in skill .md files
• GitHub Actions workflow vulnerabilities (script injection, token exposure)
• Accidentally committed API keys, tokens, or credentials
• Adversarial snippets targeting the Phase 3 Dependency Auditor execution environment

• Issues in third-party frameworks or models referenced by skill files (report those upstream)
• Theoretical AI safety concerns in documented skills (open an issue for discussion instead)
• Social engineering attacks

When contributing skill files:

• ✅ Never include real API keys, tokens, or passwords in code examples — always use placeholders like YOUR_API_KEY
• ✅ Use environment variables for sensitive values in examples: os.environ['API_KEY']
• ✅ Do not demonstrate actual exploits — describe vulnerabilities conceptually, don't provide working attack code
• ✅ Flag experimental skills with stability: experimental if they involve risky operations
• ✅ Include security notes in skill files that involve privileged actions, file deletion, or network access

This section documents the threat model for the Dependency Auditor (dependency-auditor.yml), which executes Python code snippets from skill files in isolated virtual environments on GitHub Actions runners as part of Phase 3 of the Dependency Watchdog pipeline.

dependency-auditor.yml runs on pull requests that touch skills/**/*.md files and on a weekly cron schedule. It:

1. Parses Python code blocks from skill Markdown files
2. Creates an isolated venv per skill using tempfile.TemporaryDirectory() + venv.create(clear=True)
3. Installs the skill's declared deps into that venv
4. Executes each snippet via subprocess.run with a 30-second timeout
5. Proposes a Yellow → Green badge promotion PR if all snippets pass

The Risk: Since snippets run via subprocess.run on a GitHub Actions runner, a malicious snippet (e.g. a PR disguising crypto mining, data exfiltration, or credential harvesting as a skill code example) would have full outbound network access during execution.

The Layered Mitigations (in order of current deployment):

Current Risk Assessment: CONTROLLED but material. The repository has containment controls, but skill content can influence agent behavior and some repository workflows execute code or install dependencies. This is not equivalent to a security audit or a guarantee that every published skill is safe in every environment.

For the current scope — a curated, maintainer-reviewed repository — the ephemeral runner model is the primary and sufficient containment strategy. The runner is discarded after every job, so even a successful exfiltration attempt finds no persistent secrets, no long-lived credentials, and no reusable environment.

If abuse is detected (e.g. a PR attempts network exfiltration from a snippet):

1. Immediately close the PR and block the contributor
2. Report via the private vulnerability channel above
3. Enable Docker --network=none execution by updating the run_snippet() call in tools/dependency_auditor.py to wrap the subprocess in:

   docker run --rm --network=none -v /tmp/snippet.py:/snippet.py python:3.11-slim python /snippet.py

4. Audit the Actions runner logs for the affected job to assess blast radius

If this repository is ever opened to public, unreviewed PRs, the escalation to Docker --network=none execution must be implemented before enabling auto-trigger of the auditor on external PRs. Do not skip this step.

Skills in 14-security/ specifically cover agent safety patterns:

Thank you to everyone who responsibly discloses security issues and helps keep the AI agent community safer.

Maintained by @SamoTech · Last updated: September 2026

Skills are executable instructions from an agent's point of view. A Markdown file can therefore create security impact even when it contains no executable source code itself.

The repository applies these rules to distributed skills:

1. A skill must not require an external package, installer, CLI, URL, or service merely to understand the skill. External implementations are optional and must be clearly identified.
2. Installation commands must not be presented as mandatory agent behavior unless the dependency and trust boundary are explicitly documented and the dependency is pinned or otherwise reproducibly identified.
3. Skill content must not request secrets, disable security controls, weaken authentication, or execute destructive actions without an explicit safety boundary and human-approval path where appropriate.
4. CI must not mutate contributor branches as part of validation. Validation should be read-only; generated artifacts should be reconciled through an explicit release or PR path.
5. Automated dependency changes may merge only through the repository CI-gated merge rule: exact HEAD, required validation, security, tests, and repository invariants must pass. No separate human approval is required unless a higher-priority control-plane rule applies.
6. A "battle-tested" quality label means the repository quality criteria were met. It is not a blanket trust or malware guarantee.

For the planned Agent Skills standard distribution, each published artifact will carry a stable name, description, source path, version/provenance information, and SHA-256 integrity digest. The discovery surface will follow the /.well-known/agent-skills/index.json model and will be generated from the same canonical source rather than maintained by hand.