Privacy

What we store about you

Nothing. There are no cookies on this site, no analytics or tag-manager scripts, no session identifiers, and no fingerprinting. You do not have an account here because there is nothing to have an account for.

Your light/dark preference is kept in your browser's localStorage. It stays on your device and is never transmitted anywhere — including to us.

Fonts and every other asset are served from this domain. Nothing on a page you load causes a request to Google, a CDN, or any other third party.

Reading and downloading skills

Browsing the catalog, opening a skill, and fetching its raw SKILL.md are ordinary HTTP requests. We do not count them against you, tie them to an identity, or record what you looked at.

The install command is someone else's tool

Install commands here use npx skills, which is the third-party vercel-labs/skills CLI, not software we publish. That CLI sends its own install telemetry to its own endpoint, and what it collects is governed by its authors rather than by this page. We mention it because we are the reason you ran it.

To install without it, run DISABLE_TELEMETRY=1 in front of the command, or skip the CLI entirely and download the raw SKILL.md from the skill page.

Counting installs

Skill pages show an install count and loop pages a copy count. Both increment when someone clicks a copy control, and both store a number and nothing else — no visitor identifiers, no addresses, no sessions, and no way to reconstruct who clicked. Your browser remembers which entries you have already copied so it does not count the same one twice; that flag stays in your browser and is never sent to us. There are no per-user metrics because none are collected.

A copy is not an installation. Install commands run against GitHub, so we never see whether one succeeded — the count measures interest, and no ranking or leaderboard is published from it.

The footer thumb

The “Useful?” control in the footer records one number per page, up or down. The request carries the page path and the direction, nothing else. Only the total of the positive votes is displayed. Your browser remembers that you voted so it stops asking; that too stays in your browser.

Submitting a skill or a loop

This is the one place information reaches anybody. The submission form runs entirely in your browser and posts nothing to us — it assembles a pre-filled GitHub issue and opens it. Nothing is sent until you press submit on GitHub, and you can edit or abandon it first.

When you do submit, GitHub records it under your GitHub account, in public, on securityskills/skills. Anything you typed becomes public with it. If you fill in the optional name, company, and contact fields, that attribution is published on the skill or loop page — that is what those fields are for.

Your use of GitHub itself is covered by GitHub's privacy policy, not this one.

Hosting logs

The site is hosted on Vercel. Like any web host, its infrastructure processes standard request data — IP address, user agent, URL, timestamp — in order to serve the page and absorb abuse. We do not query those logs to profile visitors, and we build no audience, cohort, or behavioural data from them.

Removing something

If you submitted a skill or loop and want it taken down or your attribution removed, open a request or email contact@securityskills.sh. Contributions are public git history, so we can unpublish a page and remove attribution going forward, but we cannot rewrite what other people have already cloned.

Changes

If this policy changes in a way that affects what is collected, the date at the top changes with it. The history of this page is in the site repository.