# Security policy

## What these packages can do

Very little, by design. Each bundle contributes prompt text and a small loader
that reads `SKILL.md` from inside its own package directory. Together they:

- open no ports and start no servers,
- spawn no child processes,
- make no network requests,
- ship zero runtime dependencies,
- write nothing outside what the host agent itself decides to write.

The loader reads files only within its own package. Everything else a skill
causes to happen goes through DSH's own tool and permission layer, governed by
your active profile — not by anything in this repository.

## What a skill can still influence

A skill is prompt text, so its real power is *routing and framing*: it can cause
the agent to read files, and it can shape how the agent reports what it found.
Two consequences worth stating:

**Repository content is untrusted data.** Anything a skill causes the agent to
read — source files, session records, agent asset definitions, MCP config — is
data, not instructions. A file that contains text addressed to the agent should
be surfaced to you, not obeyed.

**These skills must not manufacture authority.** They ship no collectors, so
they are written to return evidence candidates rather than severities or
repository-wide scores. A change that makes a skill sound like it verified
something it cannot verify is a security-relevant change, not a wording change.

## Reporting a vulnerability

Open a GitHub security advisory on this repository rather than a public issue.
Include the affected package, the DSH version, and a minimal reproduction.
Expect an initial response within seven days.

Vulnerabilities in DeepSeek Harness itself, or in Better Harness, belong
upstream — not here.