Document skill trust model and operator security warnings

[mrmasa88]

Summary

Resolves #109 (Phase 0 — docs only). Adds an operator-facing document explaining Skillware's skill trust model, and wires links to it from the security-relevant files.

This is documentation only. It does not change SkillLoader, add flags, or implement sandboxing (those remain in #110–#114). It documents the current state honestly.

Fixes #109

What's included

• New: docs/security/skill-trust-model.md — the operator mental model:
  1. Executive summary — loading a skill runs its skill.py in the host process with full filesystem + os.environ access.
  2. On-disk resolution order (SKILLWARE_SKILL_PATH → cwd ./skills/ and parents → bundled) and shadowing.
  3. Provenance tiers (A/B/C — Bundled / Project / External), with an explicit "Sandboxed? No" for every tier.
  4. constitution is agent guidance, not Python isolation (with the defi/evm_tx_handler example).
  5. Concrete flows (pip-only, dev with ./skills/, external path) and what can go wrong.
  6. Operator checklist.
  7. Roadmap pointer ([Feat]: Skill load trust tiers — origin metadata and warnings for non-bundled skills (sub-issue of #17) #110, [Feat]: Scoped environment injection for skill execution (sub-issue of #17; complements #39) #111 + [RFC]: Pluggable Secret Management Architecture & Context Binding #39, [Feat]: Research spike — subprocess worker isolation for skill execute() (sub-issue of #17) #112–[Feat]: Optional container-backed skill execution for high-risk domains (sub-issue of #17) #114, parent [RFC]: Security Sandboxing Strategies for Untrusted Skills #17).
• New: docs/security/README.md — index for the new folder.
• Wiring: SECURITY.md (skill execution model section), docs/usage/README.md (security note on "Finding skills on disk"), CONTRIBUTING.md (registry review ≠ runtime isolation), CODE_OF_CONDUCT.md (replaced the undefined "sandboxing rules" reference with a link to the trust doc), CHANGELOG.md ([Unreleased] Documentation entry).

Acceptance bar

The doc leads with "None of these tiers are sandboxed today," and a new operator comes away understanding: no default sandbox, where code came from matters, and constitution ≠ isolation. No claim that sandboxing exists today.

Naming

The provenance tiers are labeled A/B/C in the doc, but Bundled / Project / External may read more clearly. Happy to rename to whichever you prefer before merge — flagged here rather than in the doc body so the page stays clean.

Made with Cursor