Source tampering
Git objects, bundle paths, file bytes, executable modes, context files, verifier trees, and runtime sources are fingerprinted and rechecked for drift.
Security model · Fail closed
Generated code is untrusted.
Skivolve isolates execution, binds exact sources and authorities, limits resources and spend, and documents the host threats it cannot defeat. Security claims stop at the tested boundary.
Defended paths
Controls for the evaluator’s actual attack surface.
Filesystem escape
Path containment, symlink checks, read-only bindings, pristine fixture workspaces, and isolated transient units separate generated output from authority inputs.
Credential exposure
Under a trusted digest-attested Claude executable, generated tools are denied the controller credential, outbound domains, and new Unix sockets. Claude generation fails before dispatch if the required sandbox or seccomp helper is unavailable.
Unbounded execution
Per-case timeouts, bounded artifacts, process isolation, and declared resource checks constrain attacker-controlled tasks and outputs.
Spend ambiguity
Dispatch journals, per-call and run ceilings, and forfeited interrupted reservations prevent failures from disappearing from cost evidence.
Authority substitution
Provider capabilities, comparator releases, sealed plans, and certification evidence are immutable inputs; response fields cannot elevate their own authority.
Explicit limit
Isolation is not a hostile-host guarantee.
Skivolve does not claim protection against a compromised kernel, malicious root, hostile same-UID processes outside the transient isolation unit, a checkout whose code and release locks are both already compromised, provider-side account compromise, or reviewers who collude or leak private holdout content.
Website supply chain
A static artifact with deployment-only privilege.
No runtime JavaScript
The public site serves pre-rendered HTML and CSS. It does not collect form data, load analytics, or execute a client application.
Immutable actions
Every external GitHub Action is pinned to a full commit SHA. The artifact is validated before upload.
Least privilege
Workflow permissions default to none. Source read belongs to the build job; Pages and OIDC write permissions exist only in the deploy job.
Private disclosure
Report vulnerabilities without publishing the exploit.
Use GitHub private vulnerability reporting. If private reporting is unavailable, email dhiman.seal@hotmail.com with the subject “Skivolve security report.”
Include the affected version or commit, threat model, reproduction steps, impact, and suggested mitigation. Remove real credentials, private holdout content, access tokens, personal data, and unnecessary exploit payloads.
The normative policy is maintained in SECURITY.md.