Security Model

skills.md is designed around a source-free local install, tenant-isolated server data, and auditable remote runs.

Local boundary

Local machines may keep:

• CLI and MCP configuration.
• Authentication state.
• Pins and preferences.
• Run metadata.
• Exported artifacts.

Local machines must not receive full private skill source, provider secrets, or hosted runtime internals.

Server boundary

The production API applies row-level security to tenant data and uses service context only for trusted server workflows such as authentication, billing webhooks, and workers.

Approval boundary

Premium or sensitive skills should pause before execution when the run needs money, private data access, or destructive actions.

Audit trail

Every remote run should keep:

• The skill name and version.
• Inputs and normalized prompt metadata.
• Quote and receipt details.
• Artifact manifest.
• Status transitions.
• Error logs safe for user display.