Security

skillsvault governs which agent skills reach your developers' machines and which may run. This page says how it is built to be trusted with that, and where your data goes. For how each control maps to the OWASP Agentic Skills Top 10, see the OWASP mapping.

Where your data lives

• Database: your organisation's skills, policies, members and audit log are stored in Supabase Postgres in the EU (Ireland, AWS eu-west-1).
• Application: the console and API run on Vercel, in the EU (Dublin).
• Isolation: every table is protected by row-level security that scopes rows to your organisation. Every server path that has to bypass it checks membership and role itself, and the test suite fails if a new privileged database function appears without review.

What we never receive

• Your developers' prompts. The gate decides on the machine from a signed policy bundle; it sends us the decision (skill, version, machine, verdict, policy) for your audit log, not what the agent was asked to do.
• Skill files you didn't publish. Skill content reaches us only when someone in your organisation publishes, imports or proposes a skill. skillsvault scan runs locally and sends nothing unless you choose to import its results.

How the gate is protected

• Signed policy: every policy bundle is signed with Ed25519. The CLI pins the signing key when the machine connects and refuses a bundle that doesn't verify.
• Pinned content: each published version is identified by the SHA-256 of its content. skillsvault pull refuses content that doesn't match the hash in the signed bundle, and published versions can't be edited afterwards, by anyone.
• Local decisions: decisions are deterministic and made on the machine, with no model and no network call on the path. If the control plane can't be reached, the decision stands and the audit event is queued.

The record

• Audit log: every gate decision is hash-chained to the one before it and append-only. The console verifies the chain, and the JSON export includes everything needed to verify it offline.
• Admin activity: every change to what decides a gate call (policies, skills, roles, keys, alert destinations) is recorded by the database itself with who made it, and can't be edited.
• Evidence report: a printable summary of controls, enforcement, coverage and access over a period, for auditors (Business and Enterprise).

Access

• Sign-in: an emailed sign-in link or GitHub; SSO / SAML and SCIM are available on Enterprise.
• Roles: owner, admin, governance officer, member and billing, enforced in the console and again on the server. Members can propose skills but only owners, admins and governance officers publish them or change policies.
• Agent keys: stored as hashes, never in plain text; shown once, and revocable at any time from Settings.
• Webhooks: alert destinations must be public HTTPS hosts; private network addresses are refused at every delivery, and JSON deliveries are signed with HMAC-SHA256.

AI features

The AI review (when a skill is published or proposed) and AI assist (in the editor) send that skill's content, and for assist the author's request, to our model provider. Nothing else is sent: not the audit log, not prompts from your developers' agents. The gate never uses a model. AI use is capped per person and per organisation each day.

Sub-processors

Reporting a vulnerability

Email info@skillsvault.io with Security in the subject. Please give us a reasonable time to fix an issue before disclosing it; we'll acknowledge your report and keep you informed.