Security
What we do, and what we have not done yet.
A security page is only worth reading if it admits what is missing, so this one is in two halves.
In place today
Six things that are true right now.
Credentials never leave the keychain
The CLI stores tokens in the operating system keychain and reads them at call time. Nothing is written to a dotfile, and nothing lands in a repository. Claude Code strips environment variables containing TOKEN, SECRET, KEY or AUTH from sandboxed commands, so this is also the only approach that works reliably there.
Every archive is pinned
Catalog entries are archive sources with a sha256. The client verifies the digest before anything is written to disk, so a tampered download fails rather than installs.
The client is open source
MIT licensed. It runs on your developers' machines, holds their credentials and writes into their agent directories. You should be able to read every line before you allow that, and you can.
Entitlement is enforced on the server
The filtering happens before the response is built. A client cannot ask for an object its identity is not entitled to and receive it, because that object was never in the array.
Every fetch is logged
Identity, client, object, version served, timestamp. The log is not an add-on — each request has to carry an identity for entitlement to work at all, so recording it is nearly free.
Data lives on Cloudflare
The catalog, the audit log and this website run on Cloudflare. Form submissions are stored in Cloudflare D1 and emailed through Resend, and nothing on this site is sold or shared with advertisers.
Not yet
Four things we are not claiming.
Are you SOC 2 certified?
No. It is on the roadmap for the enterprise phase and we are not going to imply otherwise on a marketing page. If a report is a hard requirement today, we are the wrong vendor this quarter.
Do you scan skills for prompt injection?
No, and it is not on the near roadmap. Snyk and Onyx Security do this properly. A publish-time check may appear later; it will never be the reason to buy Skill Belt.
Can you promise instant revocation?
For the file-based clients, the next install removes what is no longer entitled. For an already-installed Claude Code plugin we are still testing what happens when it leaves the catalog, and until that test is done the honest answer is that we do not know.
Do you offer self-hosting?
As an Enterprise arrangement. The hosted control plane is the product and we are not going to half-open it, but a regulated shop that needs it in their own network should ask.
Reporting a vulnerability
Email security@skill-belt.com. We acknowledge within two business days and will tell you plainly whether we consider a report in scope. We do not currently run a paid bounty and we will not threaten anyone who reports in good faith.
The price is on the page. That is the whole idea.
$99 a month for up to 50 people, cancelled from the billing page. If you've got a question first, ask it — a person answers.