665663cac1
Scans were sequential at ~29s per skill: 72 minutes for 150 skills against a 120-minute workflow timeout. Each scan is blocked on LLM network I/O rather than local CPU, so the work parallelizes. - Run skills through a thread pool (SKILL_SCAN_WORKERS, default 8), building one scanner per worker thread rather than sharing one, since the analyzers carry mutable per-scan state. Rate-limit retry with backoff already exists inside cisco-ai-skill-scanner, so concurrency is bounded, not retried here. - Reuse findings for skills whose package contents are unchanged, keyed on a SHA-256 over file paths and bytes. Invalidate on scanner version change, model change, --full, or a 30-day backstop from the last full scan. - Record per-skill content_hash and last_scanned in the JSON report, and disclose carried-forward findings in the markdown header, so a reused finding always shows when it was actually produced. - Sort report entries by skill name so worker completion order does not churn the committed JSON. - Lower the workflow timeout to 60 minutes; add a full_scan dispatch input. Also fixes skills/genomic-intelligence/SKILL.md, whose unquoted description contained a colon-space that made its YAML frontmatter invalid. The loader had been rejecting it silently, so every scan covered 149 of 150 skills.
6.2 KiB
Security Policy
This is the security policy for Scientific Agent Skills, maintained by K-Dense.
GitHub surfaces this file as the repository's security policy. It is hand-authored. The output of our automated skill scanning is a separate document — see Automated skill scanning below.
Reporting a vulnerability
Please do not open a public issue for a security vulnerability.
Use GitHub's private vulnerability reporting, which keeps the report confidential until a fix is available:
Security tab → Report a vulnerability
Please include, as far as you are able:
- The affected skill (or repository tooling) and the version or commit you observed it on
- What an attacker could achieve, and what access they would need to achieve it
- The steps to reproduce, ideally with the smallest input that triggers it
- Any agent host and model you reproduced it on, since skill behavior varies by host
We will acknowledge your report and tell you whether we consider it in scope. If we accept it, we will keep you informed as we work on a fix and will credit you in the release notes unless you ask us not to.
Supported versions
| Version | Supported |
|---|---|
main |
✅ |
| Latest tagged release | ✅ |
| Earlier tagged releases | ❌ — fixes land in a new release rather than being backported |
If you pin skills to a tag or commit (see the version-pinning section of the README), you are responsible for moving that pin forward to receive fixes.
What is in scope
This repository distributes Agent Skills: instructions, reference material, and bundled scripts that an AI agent reads and may execute on your machine. In-scope reports concern content in this repository that could harm someone who installs it:
- A bundled script that reads credentials, files, or environment variables it has no reason to read, or that transmits data to an unexpected destination
- Instructions in a
SKILL.mdthat steer an agent toward destructive, exfiltrating, or unauthorized action - Prompt-injection vectors — including content in
references/orassets/that an agent is instructed to treat as authoritative - A skill whose documented behavior materially misrepresents what its bundled code does
- Unsafe credential handling, such as instructions to place secrets where they will be committed or logged
- Vulnerabilities in this repository's own tooling (
scan_skills.py,scan_pr_skills.py,validate_report.py) or its GitHub Actions workflows
What is out of scope
- Vulnerabilities in the third-party libraries and services a skill documents. A flaw in RDKit, Scanpy, or a public API belongs to that project — please report it upstream. A skill that instructs users to use a library unsafely is in scope here.
- Vulnerabilities in agent hosts. Issues in Claude Code, Cursor, Codex, and similar belong to those vendors.
- The inherent capability of skills. Skills are instructions for an agent that can execute code; a skill performing the work it documents is not a vulnerability. See the Security Disclaimer in the README.
- Missing version pins on documented dependencies, unless you can show a concrete exploitation path.
Before you install
Skills execute code and influence your agent's behavior. Review what you install, and prefer installing the subset of skills you actually need. Bundled scripts that reach the network or read credentials are documented as such in the relevant SKILL.md. Treat skill content from any source — including this repository — as code review material, not as trusted input.
Automated skill scanning
Skills in this repository are scanned using cisco-ai-skill-scanner, which combines static behavioral analysis, trigger analysis, and LLM-assisted review. Changed skills are scanned on every pull request.
The scheduled scan runs weekly and is incremental: a skill whose package contents are unchanged since the last scan carries its previous findings forward rather than being rescanned. Every skill is rescanned in full whenever the scanner version or the model changes, when a maintainer triggers a full run, and at least every 30 days regardless. Each skill's last_scanned date is recorded in the JSON report, so you can always see when a given finding was actually produced.
- Report:
docs/security-report.md(machine-readable companion:docs/security-report.json) - Workflow:
.github/workflows/security-scan.yml
How to read the report. It is generated by automated tooling, including a language model, and is published to be useful rather than authoritative. It is not an audit, a certification, or a guarantee. A finding in the report is a prompt to review a skill, not a determination that the skill is malicious.
Before any report is published, validate_report.py checks it against the actual contents of skills/ and blocks publication if the scan makes claims that cannot be true of the packages on disk — findings anchored to files that do not exist, cross-file behavior in single-file packages, or asserted script counts that the package does not have. When that check fails, the workflow fails and no report is published. This exists because a scanner that malfunctions would otherwise publish its own errors unreviewed.
If you believe a finding is wrong, open a regular issue (false positives are not sensitive) with the skill name, the rule ID, and why the finding cannot hold. If a class of false positive originates in the scanner rather than in our configuration, we will also raise it upstream.
Reporting a malicious skill elsewhere
If you find a skill published outside this repository that impersonates Scientific Agent Skills or K-Dense, please tell us through the private reporting channel above so we can respond and warn users.