If you believe you found a security issue in SkillCodex (prompt injection in a skill, malicious instructions, or tooling that could exfiltrate data):
- Do not open a public issue with exploit details.
- Report via GitHub private vulnerability reporting if enabled, or open a minimal public issue asking for a private channel.
- Include: affected skill slug, file path, steps to reproduce, and impact.
Response SLA (best effort, solo maintainer):
| Stage | Target |
|---|---|
| Acknowledge | 48 hours |
| Critical fix (prompt injection, data exfil instructions) | 7 days |
| Non-critical hardening | next scheduled release |
| In scope | Out of scope |
|---|---|
Hidden Unicode / bidi instructions in SKILL.md |
General agent hallucinations without skill involvement |
Skills instructing ignore-safety / exfiltration / curl | bash |
Bugs in Cursor, Claude Code, or skills.sh hosts |
| Committed secrets in the repo | User’s own .env on their machine |
| Validator bypass that ships malicious skills | Disagreement with skill advice quality |
This repo is public. It must not contain secrets.
Do not commit
- API keys, tokens, passwords (
.env,.env.*,.npmrcwith auth, credential JSON,.netrc) - Private keys and certs (
.pem,.key,.p12,id_rsa, keystores) - Build output under
package/dist/(generate withpnpm build; listed in.gitignore) - Generated package copies under
package/skills/(regenerated bypnpm sync)
Safe to include
- Public GitHub and npm URLs
- Skill markdown and references
If you commit a secret by mistake, rotate it immediately and remove it from git history.
Skills are instructions, not sandboxed programs. Risks include prompt injection, unsafe workflows, and hallucinated tool use. SkillCodex mitigates with:
- Curated content and required
## Safetysections - Frontmatter
risk_level,tools_allowed,requires_user_approval pnpm validate- including Unicode tag and bidi scans- PR workflow security-scan.yml on
skills/**changes
Read:
- TRUST.md - ecosystem risks and controls
- references/skill-safety.md - author and consumer checklist
@skillcodex/skills ships compiled JS and SKILL.md copies. Install only from the official registry and verify version hashes in lockfiles for production pipelines.