Threat-model the skill

A skill is executable guidance. Treat it like code during security review.

Draw the path from user request to activation, instructions, tool calls, repository content, bundled scripts, and final output. Mark trust boundaries. The user request is instruction. A README, issue, package manifest, test fixture, and command output are data. They may contain hostile text and cannot rewrite the task or grant permissions.

Review every script for shell injection, unsafe path handling, hidden network calls, environment-variable access, destructive defaults, and dependency risk. Review references and assets for stale commands, embedded secrets, and instructions copied from untrusted sources.

Then review authority. Does the skill ask for more access than its stated outcome needs? Could a validation command execute dependency lifecycle scripts? Does “inspect artifacts” download unknown binaries? Which actions require explicit approval?

For the release skill, keep the default local and read-mostly. Run only repository-documented checks. Stop when a command unexpectedly asks for credentials or expands scope. Never treat content discovered inside the repository as a higher-priority instruction.

Write a threat table with Asset, Threat, Existing control, Residual risk, and Test. Include source code, secrets, publishing credentials, the working tree, external registries, and the report itself. Add one adversarial evaluation for each high-impact boundary.