lythoskill-deck
Manages skill governance by syncing declared skills with the working set, ensuring only necessary skills are active and conflicts are eliminated.
Install this skill
or
91/100
Security score
The lythoskill-deck skill was audited on Oct 31, 2026 and we found 5 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
low line 54
Access to home directory dotfiles
SourceSKILL.md
| 52 | |
| 53 | ``` |
| 54 | Cold Pool (~/.agents/skill-repos/) → deck add → skill-deck.toml → deck link → .claude/skills/ |
| 55 | (all downloaded skills) (declare) (desired state) (reconcile) (working set — what agent sees) |
| 56 | ``` |
low line 64
Access to home directory dotfiles
SourceSKILL.md
| 62 | ```bash |
| 63 | # Phase 1 — brand design (full form: bunx @lythos/skill-deck@<version> link …) |
| 64 | bunx @lythos/[email protected] link --deck phase1-brand.toml --cold-pool ~/.agents/skill-repos |
| 65 | |
| 66 | # Phase 2 — content creation (atomic switch, Phase 1 skills gone) |
low line 67
Access to home directory dotfiles
SourceSKILL.md
| 65 | |
| 66 | # Phase 2 — content creation (atomic switch, Phase 1 skills gone) |
| 67 | bunx @lythos/[email protected] link --deck phase2-content.toml --cold-pool ~/.agents/skill-repos |
| 68 | |
| 69 | # Done — restore parent deck |
low line 82
Access to home directory dotfiles
SourceSKILL.md
| 80 | [deck] |
| 81 | max_cards = 8 |
| 82 | cold_pool = "~/.agents/skill-repos" |
| 83 | working_set = ".claude/skills" |
| 84 |
medium line 145
Access to home directory dotfiles
SourceSKILL.md
| 143 | | Concept | One-liner | |
| 144 | |---------|-----------| |
| 145 | | Cold Pool | All downloaded skills (`~/.agents/skill-repos/`). Agent cannot see here. | |
| 146 | | skill-deck.toml | Declares desired state. Alias-as-key dict format. | |
| 147 | | deck link | Reconciler. Makes the working set match the declaration. | |
Scanned on Oct 31, 2026
View Security Dashboard