Topic overview · Skill security
Once an instruction selects tools or reads files, it is no longer text — it is software.
A skill changes behaviour: which data is considered, which tools are allowed, which steps become normal. Connected to permissions, it needs provenance, versions, tests and controlled release.
A skill’s chain of trust
Whether a skill arrives as text, configuration or plugin says little about its effect. What matters is what an agent does because of it — and whether every step from provenance to recovery stays inspectable.
01ProvenanceSource, adoption, local changes, review date.
02PermissionsRead, write, send only what the task needs.
03BoundaryEmbedded content is material, not control.
04ReleaseFour tests passed, version pinned.
05RecoveryIncident → disable, last trusted version.
01 · EffectA skill is not its file format — describe trigger, tools, permissions and stop signals.
02 · InjectionSeparate control text from working data; do not follow embedded requests automatically.
03 · Supply chainName dependencies and tested versions; no update without visible review.
Core method
The skill trust passport
Purpose & effectWhich task, and what can the skill change?
ProvenanceSource, adoption, local changes, review date.
Tools & permissionsRead, write, execute, send, delete?
Data & instruction boundaryWhich content is never new control?
Dependencies & versionWhich parts, and which version is approved?
Stop & recoveryWhen to disable, which version is trusted?
Choose a skill and evaluate the whole chain of effect: inventory the effect, secure provenance, limit permissions, run four tests, plan update and incident.