Security
PapiSkill is a multi-user public registry. Authenticated users are not trusted operators, and server-side ownership checks are mandatory.
Sensitive surfaces
- - private library skills
- - API tokens
- - GitHub OAuth account linkage
- - skill downloads
- - global registry contribution flow
- - package validation and script warnings
Requirements
- - No secrets in source control.
- - API tokens are hashed at rest.
- - Private library access requires an owner session or owner token.
- - Mutations derive the user ID from the server session.
- - The web app does not execute skill scripts.
- - Packages with scripts or risky instructions show validation warnings.
- - Global curated status comes from collaborator-published registry source.
Security finding format
Findings should name the affected route or file, auth requirement, ownership check result, exploitability, smallest safe remediation, and a verification command or test.