This project follows the OWASP Agentic Skills Top 10 (AST10) framework to mitigate security risks in AI agent skills.

Do not open a public issue for security vulnerabilities.

1. Email [email protected] with:

   • Affected skill(s) and version(s)
   • Description of the vulnerability
   • Steps to reproduce
   • Impact assessment

2. You will receive an acknowledgment within 48 hours.

3. We aim to provide a fix or mitigation within 7 days for critical issues.

Each skill has a canonical security manifest containing integrity hashes, permission rationale, execution context, and scanning results. These are the source of truth for OWASP compliance auditing.

This section maps each OWASP Agentic Skills Top 10 risk to the controls implemented in this repository.

The skills-lock.json file is not separately signed — it doesn't need to be, because the release commit and tag are both signed and GitHub-verifies them independently, and the published tarball carries a SLSA v1 provenance attestation that pins back to a specific commit SHA. The chain a consumer can verify:

1. Release tag is annotated and SSH-signed. Enforced locally by git tag -a (with tag.gpgsign=true) and verified at publish by bin/release-check.mjs via GitHub's /git/tags/<sha> API — verification.verified must be true.
2. Release commit is GitHub-verified. Since v0.4.1, bin/release-check.mjs also asserts commit.verification.verified === true for the tag's target commit via /commits/<sha>. Tag and commit signatures are independent in git; both must hold.
3. Tarball provenance attests the build environment. npm publish --provenance from OIDC Trusted Publisher produces a SLSA v1 attestation linking the tarball to (repo, workflow, commit SHA). Anyone can verify with npm audit signatures skills4sh@<v>. The attestation is published to the Sigstore transparency log — https://search.sigstore.dev/?logIndex=<n> (the index is printed in the publish workflow's log).
4. gitHead published with the tarball matches. bin/verify-published.mjs (runs as the last step of npm-publish.yml) asserts the registry-side gitHead field on the published version equals the commit just shipped.

Chain in one sentence: maintainer-signed commit → maintainer-signed tag pointing at that commit → SLSA-attested tarball produced by GitHub Actions OIDC from that commit → registry metadata records that same commit SHA. Any link broken by an attacker would fail at least one of the four verifications above.

Residual risk: single maintainer. All four links above resolve to the same maintainer identity (the SSH key on the repo's verification status). Compromise of that key would let an attacker forge each link. Real multi-key governance (release-signing key separate from commit-signing key, m-of-n quorum) is the only architectural fix — out of scope at single-maintainer scale, but flagged here for future v1.0+ governance.

The following findings are expected and documented:

Resolved in 3.3.0 — the following 3.2.0 findings are no longer flagged:

• COMMAND_EXECUTION (HIGH) — sudo npx playwright install-deps removed; node -e "require('playwright')" replaced with test -d node_modules/playwright; stdin node -e "…" templates moved to versioned assets/scripts/*.js.
• PROMPT_INJECTION (HIGH) — captured page content (a11y tree, DOM snapshot, interactive map) is now wrapped in an { boundary: "untrusted-page-content", source, … } envelope, with an explicit boundary section in SKILL.md.
• R009_FILE_STAGE — the /tmp/chrome-debug CDP example was removed; no temp-file staging strings remain.

Audit cycles have repeatedly raised the items below as concerns; each has been investigated and determined to be a non-issue for this codebase. Documenting them here to preempt future re-raises.

Run security scans locally:

# guardskills (skill-specific; pinned to CI version)
npx [email protected] add t4sh/skills4sh --skill agent-memory --dry-run
npx [email protected] add t4sh/skills4sh --skill discord-harvest --dry-run
npx [email protected] add t4sh/skills4sh --skill eleventy-nunjucks --dry-run --force
npx [email protected] add t4sh/skills4sh --skill localhost-screenshots --dry-run

# Local scan-local (any skill folder, useful before or after pushing):
# npx guardskills scan-local skills/<name> --json

# Verify content hashes (includes references/ subdirectory)
for skill in agent-memory discord-harvest eleventy-nunjucks localhost-screenshots; do
  echo "=== $skill ==="
  find "skills/$skill" -type f -not -name '.DS_Store' | sort | while read -r f; do
    relpath="${f#skills/$skill/}"
    echo "  $relpath: $(shasum -a 256 "$f" | cut -d' ' -f1)"
  done
done