# CarrySkills v3.9.1 — Security Audit

## New controls
- Hard safety gate runs against the actual selected `SKILL.md` content before prompt-pack generation.
- Existing blocked prompt-injection/destructive patterns remain enforced.
- Hidden bidirectional Unicode and unsafe localhost/metadata targets remain blocked.
- Suspected private keys, AWS-style access keys, and GitHub-style access tokens are hard-blocked.
- Possible model API token material raises the Skill to restricted review rather than being silently copied.
- Skill files over 1 MB are rejected from the active prompt path.
- Strict profile rejects restricted/powerful Skills.
- Balanced/Explorer do not bypass hard blocks.
- Secret-redaction, evidence, read-only-first, and destructive-change confirmation instructions are injected into the prompt pack when enabled.
- No action/test/deployment may be claimed unless actually performed.

## Privacy
Workspace persistence is browser-local. Selected Skill IDs and preferences can be remembered. Task text is not remembered by default and is saved only when the user explicitly enables it.

## Limitations
Static inspection reduces risk but cannot prove a Skill is harmless. A Skill may contain subtle unsafe logic that does not match known patterns. CarrySkills therefore continues to use least privilege, review status, reversible actions, and user authorization boundaries as layered controls.


## v3.9.1 recovery controls
- Release mailbox must be a private WordPress page; public/non-private mailbox state is rejected.
- Release envelope requires a newer version and validated CarrySkills ZIP; SHA-256 is verified when supplied.
- State backup sanitizer excludes secret/credential key paths and stores the snapshot in a PHP-guarded file.
- Rollback accepts only files inside CarrySkills' own backup directory and creates a rescue backup before replacement.
- Restored files are syntax/integrity checked against the backup's own target version before safe state is applied.