Scientific Agent Skills
Scientific Agent Skills Security and Operations: Protect Credentials, Data, and Provenance
A source-backed security guide for Scientific Agent Skills covering prompt injection, database credentials, outbound domains, evidence retention, and incident response.
What you will learn
- Threat-model skill and host boundaries
- Constrain credentials and egress
- Operate provenance and incident response
Before you start
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
Key takeaways
- Treat retrieved science text and SKILL.md instructions as untrusted execution inputs.
- Scope credentials and network egress per skill, with fail-closed timeouts.
- Keep raw evidence, citations, checksums, retention, and incident rollback explicit.
Threat-model the host and the skill
A Scientific Agent Skill can be discovered from a markdown contract but still invoke shell commands, package tools, or external APIs. Threat-model the host, the selected skill, its dependencies, and the data it receives. Keep the first run in a disposable project with no patient, customer, or proprietary lab data.
Prompt injection can arrive through a paper, dataset, or API response. Treat retrieved text as untrusted input, keep tool permissions explicit, and require a human confirmation before a skill changes files, sends data, or submits a result to an external service.
Constrain credentials and network egress
Issue the smallest API scope for the selected database, store secrets in the host credential manager, and never place them in SKILL.md, prompts, fixtures, or logs. Use an allow-list of domains and block network access for local-only fixtures; a timeout should fail closed rather than trigger an unreviewed fallback provider.
Rotate credentials after experiments and record which skill revision used them. If a provider reports a quota or authentication error, preserve the error class and query hash without copying bearer tokens into the evidence record.
Make evidence tamper-evident
Store source URLs, identifiers, database versions, retrieval dates, and checksums alongside generated summaries. Separate raw responses from model-written interpretation and mark corrections or reviewer annotations. This prevents a fluent paragraph from obscuring a changed record or an unverified citation.
Limit retention to the stated research purpose, encrypt exported reports, and redact personal data before sharing. A reviewer should be able to reproduce the lookup without receiving the original private sample.
Operate incidents and upgrades
Monitor failed calls, unusual domains, permission escalations, repeated retries, and unexpected file writes. On suspicion, disable the skill, revoke its credentials, preserve a redacted receipt, and compare the running revision with the pinned manifest. Do not delete evidence before the incident owner decides retention.
Replay a fixed fixture after every skill, host, or database upgrade. A clean result requires the same identifiers and citations, no new egress, and a documented rollback that removes cached outputs and generated files.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Run a selected skill in a disposable, data-minimized host.
- 2
Allow-list domains and issue scoped credentials from a secret manager.
- 3
Record identifiers, sources, versions, checksums, and reviewer annotations.
- 4
Monitor egress and writes, revoke on incident, and replay fixtures after upgrades.
Copy-ready example
skill_policy:
network_allowlist: [api.example.org]
filesystem: read-only
secrets: [SCOPED_API_KEY]
log_redaction: bearer_tokens,private_samples
retention_days: <policy-value>Frequently asked questions
Can a retrieved paper be trusted as an instruction?
No. Treat papers, datasets, and API responses as untrusted content and keep tool permissions separate from their text.
What is the first incident action?
Disable the skill and revoke scoped credentials, preserve a redacted receipt, then investigate the pinned revision and outbound activity.
Sources
- Scientific Agent Skills README (captured 2026-08-31)Source checked 2026-08-31
- Scientific Agent Skills repositorySource checked 2026-08-31