* docs: add threat model for skills over MCP (SEP-2640)
Add docs/threat-model.md covering the delivery and host-handling layer
for skills served over MCP. Recommends the install (materialize to a
host-private, immutable store) path as the baseline over load-on-demand,
enumerates non-archive threats (T1-T7) with a full per-fixture mapping to
the dangerous-skills-mcp corpus and to SEP-2640 clauses, folds in the
mcpkit reference-implementation findings, and keeps the archive threat
model as an appendix (archives are slated for removal from this version).
Index the new doc in the README repository-contents table.
🦉 Generated with Claude Code
* docs: refine threat model by removing out-of-scope content and clarifying core boundaries
* docs: reconcile threat model with current SEP-2640 revision
Update the threat model to track the canonical sep/skills-extension
revision instead of the stale local working draft, and address review
feedback on PR #108.
- Retire skill://index.json terminology in favor of skills/list +
skills/get and the per-file `resources` digest set.
- Mark the B1 supporting-file-digest gap closed: `resources` now
enumerates every file with a digest and unlisted reads are
verification failures. Flip adv-supporting-file-digest-swap status.
- Reframe archives as a deferred feature (SEP Appendix: Deferred
Features); mark archive fixtures Deferred and `refunds` Resolved
(skills are keyed by uri, not name).
- Add T8 cross-origin name-collision impersonation, T9 nested-skill
consent, and a directory-walk subtree-escape row under T5, each
flagged as not yet exercised by the corpus.
- Add a Scope note on skill-catalog metadata confidentiality.
- Add the missing "Residual gaps and future directions" section
(previously referenced but absent), covering the unsigned-digest
trust-anchor gap and the third-party attestation direction.
🦉 Generated with [Claude Code](https://claude.com/claude-code)
* docs: add discovery-surface grounding and enumeration-exhaustion threat
- Add a "Protocol surface" paragraph to the system model naming
skills/list, skills/get, and resources/directory/read and what each
exposes, so threats can reference them against a stated baseline.
- Add enumeration/pagination exhaustion to T6: a server returning an
unbounded skills/list or resources/directory/read stream via an
endless nextCursor exhausts the host at discovery time, before any
file is fetched. SEP bounds neither page nor entry count; flagged as
no corpus fixture yet. Reflected in the fixture map and residual gaps.
🦉 Generated with [Claude Code](https://claude.com/claude-code)
* docs: copy-edit threat model to reduce em-dash and antithesis density
Style-only pass over prose I wrote. No change to any technical claim,
normative keyword, fixture reference, or table. Thins the em-dash habit
(convert appositive/dramatic dashes to periods, commas, or parens) and
de-duplicates the "X, not Y" closer, keeping only the load-bearing
contrasts. Definition-list and reference-list dashes left as-is.
🦉 Generated with [Claude Code](https://claude.com/claude-code)
64db7eaf72