Security
How to report a security issue with seoskills.sh or a skill listed here, what we do when you report one, and how takedowns work.
Last updated
Reporting a vulnerability
Please report security issues privately, not in a public issue. Open a private vulnerability report on the catalog repository at github.com/seoskills-sh/catalog/security/advisories/new. Include enough detail to reproduce the issue, and, if it concerns a listed skill, the skill URL.
Please do not run denial-of-service tests, access data that belongs to others, or run destructive actions against the live site.
What happens next
- We acknowledge your report within 1 business day.
- If it is a credible risk in a listed skill, we take the skill down promptly. A removed skill returns a 404 and drops out of the catalog, the API, the MCP endpoint and the discovery index, so it can no longer be installed from here.
- We tell the skill author, and re-list the skill only after a fixed version passes review.
- For an issue in the site itself, we fix it and confirm back to you.
What we check
Every skill is a public GitHub repository you can read before you install it. We run a static scan of the SKILL.md of each skill for risky command patterns and show the result on the skill page. We do not run skill code ourselves. A scan is a signal, not a guarantee, so treat any skill as third-party software: read what it does, and only install what you trust.
Scope
This covers seoskills.sh and the skills listed in the directory. The machine-readable version of this policy is at /.well-known/security.txt. For anything that is not a security issue, see the contact page.