Please report suspected vulnerabilities privately via GitHub Security Advisories ("Report a vulnerability"). Do not open a public issue for security reports. You can expect an acknowledgement within a week. Please include reproduction steps and the OS / Node.js version.

Agent Skill Hub is a localhost-only, read-only inventory tool. It assumes the machine's local user is trusted; it defends the boundary between this app and other software running on the same machine or in the same browser.

• Other local pages and processes. The server binds to 127.0.0.1 only. Requests must carry a loopback Host header (DNS-rebinding guard) and, when a browser sends an Origin, it must exactly match this instance's configured origins — merely being another localhost port is not enough. All API surfaces except health, static assets, and the bootstrap exchange require a session that only the opened browser tab can obtain: a single-use bootstrap token handed over in the URL fragment (never in query strings, requests, or logs) and exchanged for an HttpOnly; SameSite=Strict cookie that lives in server memory and dies with the process.
• Cross-site request forgery. Every state-changing request (including scans and optional prompt-history writes) must carry the per-session X-Agent-Skill-Hub-CSRF header — compared with a constant-time check — and a JSON content type, which HTML forms cannot produce. CORS is disabled; no Access-Control-Allow-Origin header is ever sent.
• Filesystem boundary escapes. Content is only read inside the home directory, approved project roots, and explicitly approved extra roots. Approving a root is the only act that accepts a raw path, and it rejects filesystem roots, the home directory and its ancestors, and overlapping approvals. Every content read re-validates the stored lexical path and the live realpath against the live boundary stores, so a symlink swapped after a scan (TOCTOU) or a just-removed boundary is refused with 403. Scan-time symlinks whose targets escape every boundary are reported but never read. Content APIs accept server-issued IDs only — no raw-path file-read endpoint exists.
• Secret and path leakage in logs. Log output masks the home directory to ~ and redacts token/cookie/authorization/CSRF/session fields. Unexpected errors return an opaque internal-error body; stacks and full paths stay in the local server log.

• A hostile local OS user with your privileges (they can read $HOME/.agent-skill-hub directly, like any of your files).
• Malicious content inside skill files themselves. The hub renders SKILL.md as sanitized markdown and never executes skill code, but the prompts you copy into a coding agent operate on those files — review high-risk prompts before running them.
• Physical access, kernel/OS compromise, or a compromised browser profile.

• No telemetry, no crash upload, no external network calls at runtime.
• No shell execution and no skill file-write APIs (the Prompt Center only generates text for you to review).
• All app state stays under $HOME/.agent-skill-hub/; state files are written atomically and corrupted files are backed up, never silently overwritten.
• Sessions cannot be persisted or resumed: restarting the process invalidates every session and issues a fresh single-use bootstrap link.

Before any release: pnpm lint && pnpm typecheck && pnpm test && pnpm build && pnpm verify:registry && pnpm audit --prod --audit-level high && pnpm smoke:package, plus the 3-OS CI matrix. The release checklist in docs/RELEASE_CHECKLIST.md lists the stop conditions that block publishing.