Writing secure skills

Your agent follows a skill's instructions with your permissions. A skill that tells it to run a remote script or read ~/.ssh is dangerous even when it was written with good intentions. These guidelines keep your users safe — and your package at security grade A.

The big four#

1. No remote code. Never pipe a download into a shell (curl … | bash, iwr … | iex). Pin tools with a package manager and a version instead.
2. No secrets. Do not read SSH keys, cloud credentials, browser profiles or .env files, and never print or upload environment variables.
3. No data leaving the machine unless that is the whole point of the skill — and then to a documented host, with the user's confirmation.
4. No hidden instructions. No invisible Unicode, no HTML comments with instructions, no "ignore previous instructions" or "without telling the user".

Be explicit about destructive steps#

rm -rf, git push --force, dropping tables: ask the agent to confirm with the user first, and scope the command narrowly (a path inside the project, a named branch).

Keep scripts small and readable#

Every script in a skill is code the agent may execute. Prefer instructions using tools the agent already has. If you ship a script, keep it short, avoid eval, network calls and sudo, and explain in SKILL.md what it does.

Use context markers for examples#

If you need to show a dangerous command — for example in a security-review skill — mark it as a bad example or negate it ("Never run …"). Denofy then counts it as informational instead of a finding. See context rules.

Exceptions with a reason#

Sometimes a finding is intended (an official installer, a documented API host). Allow it in denofy.yml with a reason. It stays visible in the report and keeps the grade at B at most — honest, and better than hiding it. See denofy.yml.

How the grade works#

Every version starts at 100 points; findings, license problems, new risks and structure issues deduct points, and some rules cap the grade (any critical finding means F). The full table with weights and examples is on the methodology page. Your package's report shows exactly which deductions apply.