Security

Every skill version is executed in an isolated, throwaway environment, never on a machine that holds real credentials:

• Decoy home directory. The sandbox user has SSH keys, cloud credentials, registry tokens and a Docker config — all generated per run and tagged with the run id. They unlock nothing. If one appears in a network request or is read from disk, the verdict records exactly which decoy and where it went.
• Recording egress proxy. All outbound traffic goes through a proxy that logs host, path and payload shape. Hosts the skill did not declare are flagged; a decoy value leaving the sandbox is a Blocked finding.
• Syscall trace. File and socket activity is observed with strace; the skill runs as an unprivileged user so it cannot read the engine's own process environment.
• Scenarios. Setup, a representative task, and an adversarial prompt that invites the skill to misbehave. Findings from the three runs are merged into one verdict with the trace attached.

Static analysis runs first and alone is never enough for a Verified label: a version is capped at Caution until the honeypot has run.

vet-skills is open to inspection — it ships as a single JavaScript file on npm with no dependencies, and the source is in the repository linked in the footer. What it sends:

• To resolve a verdict: the skill name, version and artifact hash.
• When enrolled in an organization: each install decision (skill, version, hash, outcome, restrictions applied), the agent type (Claude Code, Cursor, …), the machine hostname and the enrolled developer's handle — what the inventory and audit log need.
• When you run vet-skills detonate: a gzipped tar of the directory you point it at, excluding node_modules and .git.

It never reads or uploads prompts, conversation history, environment variables, source code outside a detonate upload, or the contents of installed skills. The Claude Code hook is a PreToolUse entry in ~/.claude/settings.json that you can read and remove at any time.

Enroll tokens only enroll agents. They cannot read inventory, change policy, or approve installs; admins rotate them from the Onboarding page and the previous token stops working immediately.

• Sign-in is passwordless: Google, LinkedIn, or a one-time email link that expires in 15 minutes and is stored only as a hash.
• Sessions are HMAC-signed, HttpOnly, Secure, SameSite=Lax cookies with a 30-day lifetime.
• Organization roles — developer, approver, admin, owner — gate every mutating action server-side; platform administrators are a separate, explicitly granted role.
• Enroll and API tokens are stored as SHA-256 hashes; the plaintext is shown once.
• Payments are handled by Stripe. Card details never touch our servers; we store the customer and subscription ids.

The service runs on Railway (US West) behind Cloudflare, with TLS everywhere and HSTS preloaded. Postgres is private to the project network. The crawler and sandbox run in the same image with no inbound network. Secrets live in the platform's environment store and are rotated when an incident or provider notice warrants it.

Found something? Email [email protected] with steps to reproduce. We acknowledge within two business days and will credit you in the fix notes unless you prefer otherwise. Please don't test against other customers' organizations; a trial org of your own is the right place. See also the privacy policy.