Skip to main content

Security-First Design

AI skills are executable instructions. skillshare treats them as untrusted input.

The Threat Model​

When you install a skill from GitHub, you're giving an AI tool instructions that will influence code generation, file modifications, and potentially command execution. A malicious skill could:

  • Inject prompts that override the AI's safety guidelines
  • Exfiltrate data by instructing the AI to send file contents to external URLs
  • Execute destructive commands through the AI's shell access
  • Steal credentials by accessing environment variables or config files

This is not theoretical. Prompt injection is the #1 security concern in AI tooling.

The Audit Engine​

skillshare includes a built-in security scanner (skillshare audit) that checks every installed skill against 15+ detection patterns across 5 severity levels:

SeverityExamples
CRITICALPrompt injection, system prompt override
HIGHData exfiltration URLs, credential access patterns
MEDIUMDestructive commands (rm -rf, DROP TABLE), file system writes
LOWNetwork requests, external tool invocation
INFOLarge file sizes, unusual formatting

How It Works​

The audit engine scans SKILL.md content using pattern matching and heuristics:

# Scan all installed skills
skillshare audit

# JSON output for CI integration
skillshare audit --json

# Scan project skills only
skillshare audit -p

Automatic Blocking​

During skillshare install, the audit runs automatically. If a CRITICAL finding is detected, installation is blocked:

CRITICAL: Prompt injection detected in "malicious-skill"
  → Pattern: "ignore previous instructions"
  → Installation blocked. Use --force to override (not recommended).

Defense in Depth​

The audit engine is one layer. skillshare's security model includes:

  1. Audit at install time — catch threats before they reach your AI tools
  2. Audit on demand — re-scan existing skills as new patterns are added
  3. Shared source — linked targets read the same skill files; source changes reach all of them, so review changes and limit who can write to the source
  4. Backup before changes — skillshare backup snapshots your entire skill library
  5. Trash with TTL — deleted skills go to trash first, not permanent deletion
  6. Operation logging — every mutating operation is logged to operations.log (JSONL)

Symlinks provide a common source, not a security sandbox. Likewise, .skillignore filters skill discovery; it does not deny an AI tool access to files or commands. Runtime permissions and approvals belong to the AI tool. See Shared Source and Execution Boundaries for the full separation of responsibilities.

Supply Chain Considerations​

The AI skill ecosystem is young. There are no package registries with review processes, no code signing, no dependency resolution. Skills are Markdown files in git repositories.

skillshare's approach:

  • Scan everything — even skills from trusted sources
  • Block by default — CRITICAL findings prevent installation
  • Log everything — audit results are stored for forensic review
  • Update patterns — new detection patterns ship with each skillshare release

Configuring Audit Behavior​

Set the block threshold in config.yaml to control what severity blocks installation:

# config.yaml
audit:
  block_threshold: HIGH   # Block on HIGH and CRITICAL (default: CRITICAL)

For per-rule customization, use a separate audit-rules.yaml file (initialized with skillshare audit --init-rules):

# audit-rules.yaml
rules:
  - id: network-request-0
    enabled: false          # Disable this specific rule
  - id: my-custom-check
    severity: MEDIUM
    pattern: "TODO|FIXME"
    description: Policy violation — unresolved TODOs