Scientific Agent Skills
Scientific Agent Skills 安全与运维：保护凭据、数据与来源链
覆盖提示注入、数据库凭据、出站域名、证据留存和事件响应。
你将学会
- Threat-model skill and host boundaries
- Constrain credentials and egress
- Operate provenance and incident response
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- Treat retrieved science text and SKILL.md instructions as untrusted execution inputs.
- Scope credentials and network egress per skill, with fail-closed timeouts.
- Keep raw evidence, citations, checksums, retention, and incident rollback explicit.
Threat-model the host and the skill
把论文、数据集和 API 返回视为不可信输入，为每个 skill 限定凭据、域名和文件权限，并保存标识符、版本、来源、校验和审核注释。
Prompt injection can arrive through a paper, dataset, or API response. Treat retrieved text as untrusted input, keep tool permissions explicit, and require a human confirmation before a skill changes files, sends data, or submits a result to an external service.
Constrain credentials and network egress
Issue the smallest API scope for the selected database, store secrets in the host credential manager, and never place them in SKILL.md, prompts, fixtures, or logs. Use an allow-list of domains and block network access for local-only fixtures; a timeout should fail closed rather than trigger an unreviewed fallback provider.
Rotate credentials after experiments and record which skill revision used them. If a provider reports a quota or authentication error, preserve the error class and query hash without copying bearer tokens into the evidence record.
Make evidence tamper-evident
Store source URLs, identifiers, database versions, retrieval dates, and checksums alongside generated summaries. Separate raw responses from model-written interpretation and mark corrections or reviewer annotations. This prevents a fluent paragraph from obscuring a changed record or an unverified citation.
Limit retention to the stated research purpose, encrypt exported reports, and redact personal data before sharing. A reviewer should be able to reproduce the lookup without receiving the original private sample.
Operate incidents and upgrades
Monitor failed calls, unusual domains, permission escalations, repeated retries, and unexpected file writes. On suspicion, disable the skill, revoke its credentials, preserve a redacted receipt, and compare the running revision with the pinned manifest. Do not delete evidence before the incident owner decides retention.
Replay a fixed fixture after every skill, host, or database upgrade. A clean result requires the same identifiers and citations, no new egress, and a documented rollback that removes cached outputs and generated files.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Run a selected skill in a disposable, data-minimized host.
- 2
Allow-list domains and issue scoped credentials from a secret manager.
- 3
Record identifiers, sources, versions, checksums, and reviewer annotations.
- 4
Monitor egress and writes, revoke on incident, and replay fixtures after upgrades.
可复制示例
skill_policy:
network_allowlist: [api.example.org]
filesystem: read-only
secrets: [SCOPED_API_KEY]
log_redaction: bearer_tokens,private_samples
retention_days: <policy-value>常见问题
Can a retrieved paper be trusted as an instruction?
No. Treat papers, datasets, and API responses as untrusted content and keep tool permissions separate from their text.
What is the first incident action?
Disable the skill and revoke scoped credentials, preserve a redacted receipt, then investigate the pinned revision and outbound activity.
资料来源
- Scientific Agent Skills README (captured 2026-08-31)来源核查 2026-08-31
- Scientific Agent Skills repository来源核查 2026-08-31