yao-meta-skill

Least-privilege permissions

• Restrict skill access to data it needs only. Each reusable skill should only connect to the specific databases, files, or systems required for its job—not broad access to everything. Review and limit these access rights quarterly.
• Require approval chains for sensitive skills. Skills that handle customer data, financial records, or user information should need sign-off from a manager before deployment, not automatic activation.
• Separate production from testing environments. Run new or untrusted skills in a sandbox first where they can't affect real customer data or operations.

Network isolation

• Vet external skills before importing. Before using a skill built by another team or vendor, verify its source and have a security review. Require documentation of what data it touches and where it sends information.
• Limit outbound connections. Skills should only communicate with pre-approved internal systems and services. Block unexpected network calls to external websites or unknown servers.
• Log all skill-to-skill data handoffs. Track what information moves between different skills. This creates an audit trail if something goes wrong and reveals unexpected data flows.

Monitoring

• Track skill execution in real time. Log when each skill runs, who triggered it, what data it accessed, and what it output. Alert teams immediately if a skill behaves unusually.
• Audit changes to skill definitions. Any update to how a skill works—including its rules or settings—should be recorded and reviewed. Prevent unauthorized modifications.
• Set thresholds for anomalies. Flag skills that suddenly process much larger datasets, run at unusual times, or access systems they never touched before.

Red flags to watch for

• Unclear data dependencies. If a skill's documentation doesn't clearly explain what data sources it uses or why, stop and request clarification before deployment.
• Skill behavior that changed without updates. If a skill suddenly produces different outputs or accesses new systems without a recorded change, investigate immediately for compromise.
• Skills with "admin" or unrestricted permissions. Any skill claiming it needs full system access is a security risk—push back and demand specific, limited permissions instead.