Security of academic-pptx

A skill has no tools of its own. It’s instructions, plus any scripts in its folder, that your agent loads when a task needs them, so it can do whatever your agent is allowed to do. We scan the whole SKILL.md for instructions that hide what they do, reach for credentials, run downloaded code or send data out.

• Hidden instructionsNothing tells the agent to override its rules or keep things from you.
  Passed
• Invisible textNo invisible or direction-flipping characters.
  Passed
• Access to credentialsNo reaching for SSH keys, cloud credentials, wallets or the keychain.
  Passed
• Downloads and runs codeNo piping downloads into a shell or running encoded payloads.
  Passed
• Sends data outNo uploads of credential files or catch-all collection endpoints.
  Passed
• Leaked secretsNo API keys, tokens or private keys published by mistake.
  Passed

A skill has no tools of its own. It’s instructions, plus any scripts in its folder, that your agent loads when a task needs them, so it can do whatever your agent is allowed to do. We scan the whole SKILL.md for instructions that hide what they do, reach for credentials, run downloaded code or send data out.