Add threat model doc for skills extension (#108)

* docs: add threat model for skills over MCP (SEP-2640)

Add docs/threat-model.md covering the delivery and host-handling layer
for skills served over MCP. Recommends the install (materialize to a
host-private, immutable store) path as the baseline over load-on-demand,
enumerates non-archive threats (T1-T7) with a full per-fixture mapping to
the dangerous-skills-mcp corpus and to SEP-2640 clauses, folds in the
mcpkit reference-implementation findings, and keeps the archive threat
model as an appendix (archives are slated for removal from this version).

Index the new doc in the README repository-contents table.

🦉 Generated with Claude Code

* docs: refine threat model by removing out-of-scope content and clarifying core boundaries

* docs: reconcile threat model with current SEP-2640 revision

Update the threat model to track the canonical sep/skills-extension
revision instead of the stale local working draft, and address review
feedback on PR #108.

- Retire skill://index.json terminology in favor of skills/list +
  skills/get and the per-file `resources` digest set.
- Mark the B1 supporting-file-digest gap closed: `resources` now
  enumerates every file with a digest and unlisted reads are
  verification failures. Flip adv-supporting-file-digest-swap status.
- Reframe archives as a deferred feature (SEP Appendix: Deferred
  Features); mark archive fixtures Deferred and `refunds` Resolved
  (skills are keyed by uri, not name).
- Add T8 cross-origin name-collision impersonation, T9 nested-skill
  consent, and a directory-walk subtree-escape row under T5, each
  flagged as not yet exercised by the corpus.
- Add a Scope note on skill-catalog metadata confidentiality.
- Add the missing "Residual gaps and future directions" section
  (previously referenced but absent), covering the unsigned-digest
  trust-anchor gap and the third-party attestation direction.

🦉 Generated with [Claude Code](https://claude.com/claude-code)

* docs: add discovery-surface grounding and enumeration-exhaustion threat

- Add a "Protocol surface" paragraph to the system model naming
  skills/list, skills/get, and resources/directory/read and what each
  exposes, so threats can reference them against a stated baseline.
- Add enumeration/pagination exhaustion to T6: a server returning an
  unbounded skills/list or resources/directory/read stream via an
  endless nextCursor exhausts the host at discovery time, before any
  file is fetched. SEP bounds neither page nor entry count; flagged as
  no corpus fixture yet. Reflected in the fixture map and residual gaps.

🦉 Generated with [Claude Code](https://claude.com/claude-code)

* docs: copy-edit threat model to reduce em-dash and antithesis density

Style-only pass over prose I wrote. No change to any technical claim,
normative keyword, fixture reference, or table. Thins the em-dash habit
(convert appositive/dramatic dashes to periods, commas, or parens) and
de-duplicates the "X, not Y" closer, keeping only the load-bearing
contrasts. Definition-list and reference-list dashes left as-is.

🦉 Generated with [Claude Code](https://claude.com/claude-code)

README.md

@@ -39,6 +39,7 @@ See [problem-statement.md](docs/problem-statement.md) for full details.
 | [Open Questions](docs/open-questions.md) | Unresolved questions with community input (see also [issues](https://github.com/modelcontextprotocol/experimental-ext-skills/issues) and [meeting notes](https://github.com/modelcontextprotocol/modelcontextprotocol/discussions/categories/meeting-notes-skills-over-mcp-wg)) |
 | [Experimental Findings](docs/experimental-findings.md) | Results from implementations and testing |
 | [Related Work](docs/related-work.md) | SEPs, implementations, and external resources |
+| [Threat Model](docs/threat-model.md) | Threat model for skills served over MCP (SEP-2640), with delivery-model recommendations and an archive appendix |
 | [Decision Log](docs/decisions.md) | Record of key decisions with context and rationale |
 
 ## Contributing