Privacy Policy

How we handle public and private audits.

Public Audits

By default, URLs submitted to Agent Skill Audit are treated as Public. Public audits are visible in the global directory, helping the community build a shared cache of safe and malicious repositories. Anyone can query the cache for a public audit.

Private Audits

Raw markdown text submissions (`source_type="text"`) are forced to be Private by default to prevent accidental leakage of proprietary agent logic.

Private audits are completely hidden from the public directory. Only the API Key that originally requested the audit is authorized to view its findings or query its cache status. If another user requests the exact same private file, the system will execute a completely fresh audit rather than revealing the cached existence of the prior run.

Data Retention

We store the normalized source URL (or a SHA256 hash for text payloads), the structured findings, and the policy decision. We do not store or log the raw text payloads submitted for private analysis, aside from the sanitized excerpts required as "evidence" for specific malicious findings.