Skill Safety
Data Sheet

Core Principle: Rate the inherent hazard, then prescribe containment. A skill that CAN send emails gets the flag and score, even if it's "supposed to" only draft them.

Score each factor 0–4 based on the highest matching rule.

H (Host Risk) — System Access

D (Data Risk) — Sensitive Data Exposure

A (Actuation Risk) — Side Effects

C (Content Risk) — Harmful Content

Flags are derived deterministically from the capabilities manifest. They indicate specific capabilities the skill has.

Execution Flags

Filesystem Flags

Network Flags

Credential Flags

Service Flags

Action Flags

Prompt Injection Flags

Content Flags

Select containment level based on the maximum HDAC score:

Required Controls by Flag

Containment Control Reference

Need automated SSDS generation & monitoring?

The canonical SSDS schema is defined in TypeScript using Zod. Full source: schemas/ssds.schema.ts

Top-Level Structure

export const SSDS = z.object({
  // Metadata
  meta: DocumentMeta,
  
  // What skill is this for?
  skill: SkillIdentification,
  
  // What can it do? (detailed capabilities for flag derivation)
  capabilities: CapabilityManifest,
  
  // How dangerous is it? (the diamond + flags)
  hazards: HazardAssessment,
  
  // How should it be deployed? (PPE equivalent)
  containment: RecommendedContainment,
  
  // What could go wrong?
  risks: KnownRisks,
  
  // What to do if something goes wrong
  incident_response: IncidentResponse,
  
  // Supporting evidence
  evidence: z.array(EvidenceItem),
  
  // Vendor extensions
  extensions: z.record(z.string(), z.unknown()).optional(),
}).strict();

HDAC Ratings

export const HdacRatings = z.object({
  H: z.number().int().min(0).max(4)
    .describe("Host risk (0-4): system access, execution, persistence"),
  D: z.number().int().min(0).max(4)
    .describe("Data risk (0-4): sensitive data access, exfiltration potential"),
  A: z.number().int().min(0).max(4)
    .describe("Actuation risk (0-4): side effects, external actions"),
  C: z.number().int().min(0).max(4)
    .describe("Content risk (0-4): harmful/sensitive content generation"),
}).strict();

Skill Identification (with Cryptographic Pinning)

export const SkillIdentification = z.object({
  name: z.string().max(200),
  version: z.string().regex(semverPattern),
  format: SkillFormat,
  description: z.string().max(5000).nullable().optional(),
  
  publisher: z.string().max(200),
  publisher_url: z.string().url().nullable().optional(),
  
  source: z.object({
    channel: DistributionChannel,  // npm, pypi, github, local, other
    url: z.string().url().nullable().optional(),
    retrieved_at: z.string().datetime().nullable().optional(),
  }).strict(),
  
  // Cryptographic pinning - CRITICAL for supply chain security
  artifact: z.object({
    sha256: z.string().regex(sha256Pattern),
    hash_method: HashMethod.default("files_sorted"),
    git_commit: z.string().regex(gitCommitPattern).nullable().optional(),
    git_tag: z.string().max(200).nullable().optional(),
  }).strict(),
  
  license: z.string().max(200).nullable().optional(),
}).strict();

Hazard Flags Enum

export const HazardFlag = z.enum([
  // Execution
  "EXEC", "CODE_EXEC", "PRIVILEGED", "PERSISTENCE",
  
  // Filesystem
  "FS_READ_WORKSPACE", "FS_READ_USER", "FS_READ_SYSTEM",
  "FS_WRITE_WORKSPACE", "FS_WRITE_USER", "FS_WRITE_SYSTEM", "FS_DELETE",
  
  // Network
  "NET_EGRESS_LOCAL", "NET_EGRESS_ALLOWLIST", "NET_EGRESS_ANY", "NET_INGRESS",
  
  // Credentials
  "CREDS_ENV", "CREDS_FILES", "CREDS_BROWSER", "CREDS_KEYCHAIN",
  
  // Services
  "SVC_EMAIL", "SVC_MESSAGING", "SVC_STORAGE", "SVC_CODE_HOST",
  "SVC_ISSUE_TRACKER", "SVC_CLOUD_INFRA", "SVC_PAYMENTS",
  "SVC_SOCIAL", "SVC_DATABASE",
  
  // Actions
  "ACT_SEND_MESSAGE", "ACT_POST_PUBLIC", "ACT_PURCHASE",
  "ACT_TRANSFER_MONEY", "ACT_DEPLOY", "ACT_DELETE_EXTERNAL",
  
  // Prompt Injection Surfaces
  "PI_WEB", "PI_EMAIL", "PI_DOCUMENTS", "PI_USER_INPUT",
  
  // Content
  "CONTENT_NSFW", "CONTENT_REGULATED",
]);

Containment Controls Enum

export const ContainmentControl = z.enum([
  // Sandboxing
  "SANDBOX_CONTAINER", "SANDBOX_VM", "SANDBOX_REMOTE", "SANDBOX_NONE_OK",
  
  // Filesystem
  "FS_READONLY", "FS_WORKSPACE_ONLY", "FS_NO_HOME", "FS_NO_SECRETS",
  
  // Network
  "NET_OFFLINE", "NET_EGRESS_BLOCK", "NET_EGRESS_ALLOWLIST", "NET_LOG_ALL",
  
  // Credentials
  "CREDS_VAULT_ONLY", "CREDS_NO_BROWSER", "CREDS_ROTATE_AFTER",
  
  // Approval Gates
  "APPROVE_SEND", "APPROVE_POST", "APPROVE_PURCHASE",
  "APPROVE_DELETE", "APPROVE_DEPLOY", "APPROVE_EXEC",
  
  // Monitoring
  "LOG_ACTIONS", "LOG_REDACT_SECRETS", "ALERT_ANOMALY",
  
  // Rate Limiting
  "RATE_LIMIT_ACTIONS", "RATE_LIMIT_EGRESS",
  
  // Review
  "REVIEW_OUTPUT", "REVIEW_DIFF",
]);

Validation Helpers

import { SSDS, validateSSDS, parseSSDS, isSSDS } from "ssds-schema";

// Safe parsing with error handling
const result = validateSSDS(data);
if (result.success) {
  console.log(result.data);  // Typed SSDS object
} else {
  console.error(result.errors);
}

// Direct parsing (throws on invalid)
const ssds = parseSSDS(jsonString);

// Type guard
if (isSSDS(unknownData)) {
  // unknownData is now typed as SSDS
}

Set confidence based on the review performed:

Confidence Basis Values

• self_attested — Publisher's claims only
• static_analysis — Automated code scanning
• manual_review — Human code review
• sandbox_test — Tested in isolated environment
• third_party_audit — Independent security review

Managed SSDS infrastructure for your organization