[tristanroth1]

What and why

After the launch post, a security practitioner asked for the skills to be assessed against an OWASP skills security checklist before they test them in a staging CI pipeline with a proof of concept. This PR publishes that assessment: reviews/security/library-security-review.md, one row per checklist item with result, evidence in this repo (file and line, validator rule, workflow step, SECURITY.md section, PR body) and, for each gap or partial, what a reader should do and whether we fix it. Linked from SECURITY.md (new "Security review record" section) and from the FAQ answer "Can a skill run code or send my data to the internet?" (one sentence, link now points to the record). SECURITY.md also lists the two execute exceptions and the setup page (R3). CHANGELOG Unreleased bullet. No release pin bump, no validator change.

Checklist chosen

OWASP Agentic Skills Top 10 (AST10), Skill Security Assessment Checklist. OWASP Incubator project, latest version "1.0-2026" on the project page; checklist source checklist.md last changed in commit f094f9a of OWASP/www-project-agentic-skills-top-10 (head d6f7d7d), read 2026-10-27, CC BY-SA 4.0 (the record names ids and our own short titles only).

• https://owasp.org/www-project-agentic-skills-top-10/
• https://owasp.github.io/www-project-agentic-skills-top-10/checklist.html

Why: it is the only public OWASP checklist written for agent skills (SKILL.md bundles). The LLM Top 10 2025 and the Agentic AI threats guide cover models and runtimes, not the skill package.

How it was checked (read-only, at acbe47e)

Validator and its 147 tests; every URL in skills/ by host; a character and pattern scan of all 62 files (0 non-ASCII, 0 invisible or bidi characters, 0 HTML, 0 code fences, 0 network or shell commands); a full read of the three skills that reach past local files; a probe of the validator with seven injected lines; gh attestation verify and gh release verify on v2026.10.20.3; branch protection, immutable releases and secret scanning through the GitHub API; review verdict lines in the bodies of #1 to #17; live build.json and response headers.

Results (81 checks)

Risk	pass	partial	gap	n/a
AST01 Malicious skills	2	3	1	0
AST02 Supply chain	1	2	0	4
AST03 Over-privileged	4	2	1	1
AST04 Insecure metadata	8	2	1	1
AST05 External instructions	2	4	0	0
AST06 Weak isolation	0	0	0	7
AST07 Update drift	0	5	0	1
AST08 Poor scanning	4	2	1	0
AST09 No governance	0	4	0	3
AST10 Cross-platform	0	6	0	0
B1 to B4 pipeline	1	4	0	4
Total	22	34	4	21

Gaps found (recommendations, not changed here)

• R1 validator (4.2): no rule for hidden text. Probe: an HTML comment with an agent directive, a zero-width character inside "ignore previous instructions", Unicode tag characters, a bidi override and "forget your instructions" all pass the validator today. security-injection does reject "ignore previous instructions", "ignore above instructions" and "disregard the above"; the article variant "ignore the above instructions" passes (checked twice at acbe47e, against the full validator and against the INJECTION patterns alone). Library is pure ASCII now, so a hidden-text rule is cheap. For the parallel validator PR.
• R2 grc-setup-review step 1 (1.6, 3.6, 5.x): the offered external setup page writes an MCP server into agent config and a routing rule into CLAUDE.md or AGENTS.md (per-step go-ahead), and is mutable outside the release. Say what it changes and link a versioned copy.
• R3 SECURITY.md accuracy: done here. SECURITY.md now names both exceptions: grc-setup-review clones at a tag after asking; submit-skill runs the local validator on the draft and runs git to open the pull request only after the contributor's yes.
• R4 documents are data (B1-3): at acbe47e only 2 of 60 skills say outright that documents read are data, never instructions. SECURITY.md states the rule here; Not checked on every output, Review record on signed outputs, AI draft challenge review #20 adds it to every skill with the data-line validator rule, so from the release that includes Not checked on every output, Review record on signed outputs, AI draft challenge review #20 it is carried and enforced.
• R5 canary run per release (1.5, 8.5, 10.1): two of the 3 gaps are that no sandboxed test run of each skill is recorded (1.5, 8.5).
• Review evidence (1.2, 8.1): the Copilot challenge records are in the repo (60 files); the seed batch's Codex review is recorded only in the body of Seed library: 60 skills, review records, grcskills.com site #1 (round 1 FIX-FIRST, round 2 fixes, no final SHIP); no per-skill second-model verdict is stored.
• 3.1 permission manifest and 4.3 opt-in: gap by format; allowed-tools pre-approves rather than restricts, so it stays out, and nothing is opt-in at the manifest level. Accepted.
• Round 2 downgrades: 4.12 (the release job holds write permissions while it runs the validator; R8 adds a separate read-only validation job), 3.8 (11 of 60 skills carry a credential NEVER line; the validator only rejects sensitive paths outside NEVER lines), 5.6 (inventory from a one-time scan, not validator-enforced), 9.1 (no per-skill hash, version or scan status), 10.6 (no security metadata in frontmatter), B4-2 (deploy evidence is not an agent audit log).
• R7 cadence (5.6, 7.4, 9.5): done as a documented manual step: AGENTS.md gains "Release (maintainers)", step 1 re-runs this review and updates the reviewed commit. CI automation open.
• R6 second scanner, R8 repo hardening options (separate read-only validation job before the release write job; enforce_admins is false, so the pin and main can move without review (7.2); no tag ruleset; unsigned commits; no CodeQL or workflow linter). Advisories reach installs only if readers watch the repo (7.6). MCP sign-in differs by agent (OAuth in the Claude plugin, OAuth or a personal token elsewhere) (10.2, 10.4).

Checks run locally

• node tools/validate.mjs: ok, 60 skills
• node --test tools/*.test.mjs: 147 pass
• site: npm ci && npm run build ok; npm test 50 pass (FAQ JSON-LD test included); SEO gate L0P pass

CODEX_REVIEW: Codex 2026-10-27 round 1 FIX-FIRST (8 fixed), round 2 FIX-FIRST (9 fixed: reclassifications, release step documented), round 3 narrow: 9 fixes verified, 2 wording errors fixed as specified in 30448ac
Owner: founder
Next: independent review by grcskills-feedback session, then merge and release

🤖 Generated with Claude Code