Trust and safety guide
Are AI skill files safe?
No AI skill file is automatically safe. A skill is a package of instructions and resources, and it may include executable scripts or pre-approved tools. Safety depends on the complete package, its provenance, permissions, runtime, data access, controls, and intended business use.
Reviewed Aug 14, 2026
Three different questions
Source verification confirms provenance and described facts; it is not a security assessment. Security review asks what the capability can access or execute and how it could be abused. Business-risk classification asks what happens to the business if the capability is wrong, compromised, unavailable, or used beyond its intended boundaries.
Review the whole operating surface
Instructions, orchestration, connectivity, and bundles expose different—but overlapping—risk surfaces.
| Decision factor | AI skill | Workflow | MCP server | Capability bundle |
|---|---|---|---|---|
| Main attack surface | Instructions, referenced files, optional scripts, pre-approved tools, and the agent that interprets them. | Triggers, credentials, nodes, integrations, data movement, model calls, and automated side effects. | Server code, authentication, scopes, tools, local execution, downstream APIs, and returned data. | Every included component plus the trust boundaries and permissions between them. |
| Review before use | Read every instruction and referenced file; inspect scripts, dependencies, tool grants, and compatibility requirements. | Inspect every node, credential, endpoint, branch, retry, failure path, and human approval point. | Verify provenance, transport, authorization, requested scopes, tool behavior, data access, sandboxing, and revocation. | Review each component separately, then test their combined permissions, data flows, failure modes, and maintenance ownership. |
| Business-risk trigger | Risk rises when instructions or scripts can change important data, publish externally, or influence sensitive decisions. | Risk rises with autonomous writes, customer contact, sensitive data, financial or legal impact, and hard-to-reverse actions. | Risk rises with broad scopes, local code execution, privileged tools, sensitive systems, and weak human confirmation. | The bundle inherits the highest meaningful risk created by any component or interaction, then adds integration and ownership risk. |
Security checklist before use
Apply the checklist to the actual version and deployment—not only the listing or format label.
Verify provenance
Confirm the creator or provider, official source, version, license, update path, and any history of corrections or incidents.
Inspect code and dependencies
Read skill instructions and referenced files; inspect scripts, workflow nodes, packages, server code, startup commands, and external endpoints before execution.
Minimize permissions
Grant only the files, tools, scopes, accounts, network destinations, and actions needed for the specific outcome.
Protect secrets and data
Identify credentials, personal data, financial data, customer content, and proprietary context; control where each can be stored, logged, or transmitted.
Require human approval
Place explicit approval before consequential writes, external communications, purchases, financial changes, legal commitments, or destructive actions.
Plan monitoring and revocation
Define logs, alerts, rollback, credential rotation, owner, review cadence, update testing, and a reliable way to disable the capability.
AC Circuit business-risk levels
The level describes plausible business consequence under the stated use—not the probability of malware or a security certification.
Low
Limited data and permissions, low consequence if wrong, easy detection, and easy reversal. Human review may be lightweight but remains appropriate before publication or external action.
Moderate
Meaningful operational or customer impact, sensitive context, or multi-system access, but bounded permissions and practical recovery. Human review is required at important decision or action points.
High
Financial, legal, security, employment, production, privileged-system, or broad customer impact; autonomous or hard-to-reverse actions; or a large blast radius. Use strict authorization, testing, monitoring, and human approval.
Not yet classifiable
The available evidence does not establish enough about deployment, permissions, data, autonomy, controls, or business use. Do not treat unknown risk as low risk.
A capability bundle inherits the highest meaningful risk created by any component or interaction. Combined permissions, data flows, autonomy, or unclear ownership can justify a higher classification.
Inspect current records
AC Circuit displays the known assessment status, data-exposure surface, business-risk level, rationale, and human-review expectation on current digital records.
Frequently asked questions
Can an AI skill file contain malware?
A skill package can include instructions, referenced files, and optional executable scripts, so unsafe or malicious content is possible. Inspect the complete package and its requested tools, dependencies, network access, and runtime permissions before use.
Does source verified mean security reviewed?
No. On AC Circuit, Source verified means the official source supports the record's stated facts. It does not mean AC Circuit installed, executed, penetration-tested, endorsed, or independently assessed the capability.
Are MCP servers riskier than skill files?
Not automatically. MCP servers commonly add live tools, data, authentication, and actions, while skill packages may include executable scripts or powerful instructions. Actual risk depends on provenance, code, permissions, data, autonomy, deployment, controls, and business consequence.
How should a business classify a capability bundle?
Classify each component and the connections between them. The bundle inherits the highest meaningful risk created by a component or interaction, and may need a higher classification when combined permissions, data flows, autonomy, or unclear ownership expand the blast radius.
Official sources
These sources support the format and security framing. AC Circuit supplies the cross-format business-risk rubric and does not claim that a source listing is a security assessment.