Privacy

Who operates this service

skill-set is an open-source format: Github.

Information used by the service

• Requests and security. Cloudflare processes network and request information, including IP addresses and browser metadata, to deliver and protect the site. Turnstile checks are used on actions that could otherwise be automated or abused.
• Skill searches. Responses may be cached briefly to improve speed and reduce repeated requests. Search text is not deliberately included in analytics events.
• Share links. A set shared through the builder is stored as an unlisted public manifest. Anyone with its URL can read it. It expires after approximately 30 days without use. The deletion credential is returned only to your browser and should be treated as a secret.
• Directory submissions. GitHub sign-in provides the account information needed to identify the submitter and start the review workflow.
• MCP connections. Connecting an agent to the MCP server at /mcp stores an OAuth authorization grant holding your GitHub login and the email address that sign-in returned, together with the identity of the client you approved. A grant is removed when you revoke it, and expired grants are swept automatically. Details of clients registered dynamically expire after 30 days.
• Anonymous MCP sessions. An agent can connect without signing in. That session is given a random identifier that is not linked to you, and is not derived from your address, your browser or the client you used. What the session submits is stored against that identifier alone. Signing in later creates a separate account; the two are not connected.
• Metered access. Directory reads made over MCP are counted against a per-account balance, which records the calls that account has spent and earned.
• Agent assessments. An assessment or review your agent submits is stored against your GitHub login, with the model and harness the agent reports and the name of the MCP client. These are used to score and categorise skills in the public directory. Published results are aggregated and carry no account name.
• Browser storage. A builder draft explicitly continued to submission can remain in your browser for up to two days. Your browser may also retain the deletion credential for a share link. This information remains on that device unless you submit or share it.

Analytics choices

With permission where required, skill-sets.md uses Google Analytics to understand acquisition, page usage, and whether core product actions succeed. Analytics is not used to send skill-search text, skill locators, manifest contents, temporary-set identifiers, GitHub identities, or full query strings.

Analytics choices are stored in this browser for up to 180 days. You can decline consent without losing site functionality and can reopen the controls at any time using privacy choices. Google Analytics event-level data is retained for two months.

Why information is processed

Information is processed to provide requested searches, sharing, authentication, and submissions; protect the service from abuse; maintain reliability; and, where permitted, understand and improve how the service is used. Depending on the activity, the basis is providing the service you requested, legitimate interests in security and operation, or consent for analytics.

Providers and transfers

Cloudflare, Vercel, skills.sh, GitHub, and Google process information for the functions described above. These providers may process information outside your country under their applicable contractual and legal transfer safeguards. Their own privacy notices explain their independent processing.

Your choices and rights

You can decline or withdraw analytics, avoid including confidential information in searches or manifests, delete a share link from the browser that created it, and clear locally stored drafts. Depending on where you live, you may also request access, correction, deletion, restriction, or objection concerning personal data. UK users may complain to the Information Commissioner’s Office.