Safety and Data

Safety and Data

Home | Command Map

skm is designed around a simple rule: show facts first, change files only through explicit guarded commands.

Read-Only by Default

These commands do not modify Claude/Codex configs, skills, MCP servers, or session logs:

skm
skm doctor
skm risks
skm report
skm scan
skm list
skm search
skm recommend
skm ask
skm graph
skm dupes
skm audit
skm sessions

Some of them update skm's own cache under ~/.skill-manager. That cache does not change Claude Code or Codex behavior.

Write Operations

Action	What changes	Safeguards
sessions --clean	Deletes session log files	Retention policy required, plan printed first, confirmation or --yes, 24-hour safety window, usage aggregated before deletion
disable/enable <skill>	Renames skill directories	Reversible, no deletion, plugin skills refused
disable/enable --mcp	Edits Claude/Codex MCP config	Backup, confirmation, reversible Codex comments, no overwrite on restore

MCP Privacy

MCP scanning does not read env values. It records only server name, tool source, transport, and command metadata needed for inventory.

Before disabling MCP servers, inspect first:

skm list --mcp
skm audit
skm risks

Session Cleanup

Always start with dry-run:

skm sessions --clean --days 30 --keep 3 --dry-run

Cleanup keeps the union of:

• sessions newer than --days
• latest --keep sessions per workspace
• sessions active within the last 24 hours

Before deleting, skm aggregates usage stats into cache, so historical audit counts are preserved.

Data Files

Path	Purpose
~/.skill-manager/catalog.json	Skill and MCP catalog
~/.skill-manager/usage-cache.json	Incremental usage cache
~/.skill-manager/audit-history/	Audit snapshots
~/.skill-manager/backups/	MCP config backups
~/.skill-manager/rules.json	User classification rules