Agent skills can instruct coding agents to run shell commands, read files, and call external APIs. Treat skill installation like adding dependencies.
Report security issues privately — do not open public issues for exploitable vulnerabilities.
- Preferred: GitHub private vulnerability reporting
- Email: security@cobusgreyling.me
| Risk | Mitigation |
|---|---|
| Skills executing destructive shell commands | Review SKILL.md before enabling; use sandboxed agent environments |
| Secret exfiltration via skill prompts | Never commit API keys; audit skills that reference network or filesystem paths |
| Supply-chain via third-party skills | Pin skill sources; prefer skills from this repo or verified authors |
This policy covers skills in this repository only. Skills copied to ~/.cursor/skills or equivalent agent paths are your responsibility to audit.