Validation & permissions

Every submission is validated before it can be listed, and every published version carries the result forever in its Skill Passport. This page explains what the checks mean and what they do not.

How validation works

The validator runs against the pinned snapshot - the exact commit that was submitted, never a branch. It parses the manifest (explicit skill.json or inferred fromSKILL.md layouts), reads every file, detects the permissions the instructions actually use, and applies rules for risky patterns: leaked credentials, prompt-injection markers, dangerous commands. An AI review then reads the skill the way an agent would and writes a plain-English account of what it does.

Statuses

Passed - no findings that need your attention.
Warning - the skill listed with advisory findings. Read them; they are "things to pay attention to", not verdicts.
Failed - a hard failure. The version cannot be published or downloaded. In practice only one thing hard-fails: a leaked secret value in the files.

This is deliberate: validation is advisory, not gatekeeping. A linter that blocks everything suspicious would just push authors elsewhere; a passport that shows you everything keeps the judgment where it belongs - with you.

Risk levels

Each version gets a low / medium / high / critical risk level rolled up from its detected permissions and findings. The CLI stays quiet about low risk and makes anything elevated impossible to miss - a medium-or-higher install asks for explicit confirmation.

The permission taxonomy

Permissions describe what a skill's instructions ask an agent to do. The validator detects them from the files (a skill also may declare them in its manifest - the passport shows both, and the gap between declared and detected is itself a signal). This table renders from the same definitions the validator uses, so it cannot drift:

Permission	Label	What it means	Weight
`filesystem.read.project`	Read project files	Read files inside the current project or workspace.	1
`filesystem.read.home`	Read home directory	Read files outside the project, including dotfiles and configs.	4
`filesystem.write.project`	Write project files	Create or modify files inside the current project or workspace.	3
`filesystem.write.home`	Write home directory	Create or modify files outside the project.	6
`env.read`	Read environment variables	Read environment variables, which often hold secrets and tokens.	5
`shell.suggest`	Suggest shell commands	Propose shell commands for the user to review and run.	2
`shell.execute`	Execute shell commands	Run shell commands directly through the agent.	7
`network.fetch`	Fetch from the network	Make outbound HTTP requests to read remote data.	3
`network.post`	Send data over the network	Transmit data to external services, a potential exfiltration channel.	5
`connector.github.read`	Read GitHub	Read repositories, issues, and pull requests via a GitHub connector.	2
`connector.github.write`	Write to GitHub	Push commits, open pull requests, or modify repositories.	6
`connector.gmail.read`	Read email	Read messages through a mail connector.	5
`connector.gmail.send`	Send email	Send messages on the user's behalf.	8
`connector.calendar.read`	Read calendar	Read events through a calendar connector.	2
`connector.calendar.write`	Write calendar	Create or modify calendar events.	4
`external.publish`	Publish externally	Post or publish content to an outside audience.	8
`external.deploy`	Deploy	Trigger deployments to live environments.	8
`external.payment`	Make payments	Initiate charges or move money.	9
`destructive.delete`	Delete destructively	Irreversibly delete files, resources, or data.	9

The AI review

Alongside the rule-based checks, a language model reads the skill's instructions and bundled scripts and answers the question regex cannot: what does this skill actually do? It produces a short summary and a judgment - clear, caution, or concern. The review runs once per source hash and is cached on the immutable passport. Skill content is treated as untrusted data throughout, so instructions inside a skill cannot steer its own review.

Immutability and diffs

A passport never changes after it is generated. A new version of a skill gets a new passport, and the download pre-flight diffs permissions between versions - so when a skill that never touched the network suddenly asks for network.fetch, you see it before anything is installed. The CLI's update command shows the same diff against the version you actually have.