Skill Registry & Governance
Govern agent skills and MCP servers as first-class artifacts — safety-scanned (prompt injection, dangerous code, undisclosed egress, over-broad permissions, provenance), policy-gated at production enablement, runtime-audited, and fed into EU AI Act Annex IV documentation.
Skills are the third governed artifact
Agent Skills — packaged, reusable capability modules (instructions + bundled scripts + declared tools/permissions + provenance) that an agent loads on demand — are governed as first-class artifacts, alongside models and prompts. A skill is a bigger attack surface than a prompt: it combines instructions (prompt-injection risk), executable code (network / exec / secret access), and declared permissions that may be over-broad or mismatched with what the code actually does. Lifecycle: register → safety scan → (draft/staging) → enable in production (gated) → runtime audit.
Safety scan
Registering or re-scanning a skill runs static checks over its manifest and returns findings with a severity and a risk score. A skill passes when it has no critical or high findings.
| Check | Detects | Severity |
|---|---|---|
| Prompt injection | Instruction-override, role reassignment, system-prompt exfiltration, covert behavior, obfuscated payloads | high |
| Dangerous code | subprocess / exec / eval, network clients, os.environ / secret access, destructive filesystem ops | high / medium |
| Undisclosed capability | Code exercises a permission (network, secrets, exec) not in declared_permissions — undisclosed egress | critical / high |
| Over-broad permissions | Wildcard '*', or a high-risk combination (e.g. exec + network) | high |
| Provenance & signing | Unsigned skills, or skills from marketplace / URL / upload sources | medium |
Policy-gated enablement
Enabling a skill in production is blocked while its safety scan fails — plus any OPA policy deny — mirroring the model promotion gate. A marketplace plugin imported as a skill must clear the same gate. Overrides require a reason and are written to the tamper-evident audit chain; every runtime invocation is recorded too.
1POST /api/v1/skills/{id}/enable { "target": "production" }
2# → 422 SKILL_NOT_SAFE
3# {
4# "target": "production",
5# "risk_score": 1.15,
6# "blocking": [
7# "[CRITICAL] Code exercises 'network' but it is not in declared_permissions (undisclosed egress).",
8# "[HIGH] Bundled script uses 'network' capability."
9# ]
10# }EU AI Act hook
Skills enabled in production shape the behavior of the AI system, so they are components that belong in the Article 11 / Annex IV technical documentation. Skills can be linked to the models and agents they modify; a model's Annex IV surfaces its linked skills, and GET /skills/governance/annex-iv returns structured evidence for all production skills — flagging unsigned or unscanned ones.
MCP Server Registry & Governance
MCP servers — the external tool providers agents mount — are governed the same way. The scan checks unauthenticated network-exposed servers (critical — the open-MCP-server pattern behind 2026's incidents), plaintext transport, SSRF-pivot endpoints, tool-description poisoning (~73% attack success in the MCPTox benchmark), obfuscation, and provenance/signing. Production enablement returns 422 MCP_SERVER_NOT_SAFE until the scan passes; overrides are audited. Endpoints: POST /mcp-servers (register+scan), POST /mcp-servers/{id}/enable (gated).