> ## Documentation Index
> Fetch the complete documentation index at: https://docs.masterskills.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust & approvals

> The two rules the agent can never break, and the machinery that enforces them.

Handing your agent the keys to a team-wide skill registry only works if the boundaries are absolute. MasterSkills has two:

<CardGroup cols={2}>
  <Card title="1. Nothing is written to disk without your approval">
    Install, update, remove — the agent lists exactly what would change and asks first. Even
    org-required skills are confirmed by the user before install. Always.
  </Card>

  <Card title="2. Nothing is published without your approval">
    Publishing is two-phase by design. The upload cannot begin until you have seen the full
    manifest and said yes.
  </Card>
</CardGroup>

These are not settings. No convenience feature bends them.

## How publishing enforces rule 2

The publish pipeline is split so that approval sits **between** packaging and upload:

<Steps>
  <Step title="Prepare — nothing leaves your machine">
    `masterskills prepare <path>` scans the folder, builds a manifest — every file with its size
    and hash, the total size, the target `@org/slug`, and the next version — and registers a
    draft. **No file content is uploaded.**
  </Step>

  <Step title="You review the manifest">
    The agent shows you the manifest, including every file that was auto-excluded by the secret
    scan. Suspicious files are never silently dropped — they are excluded **and reported**.
  </Step>

  <Step title="Publish — only the approved bytes">
    `masterskills publish-draft <draftId>` uploads and publishes that exact draft. If any file
    changed since you approved, the publish fails with `manifest_mismatch` rather than uploading
    something you didn't see.
  </Step>
</Steps>

## Secret scanning, twice

* **Client-side** — during `prepare`, files that look like secrets (`.env`, keys, tokens, local config) are excluded from the package and listed in the manifest as `excludedSecrets`.
* **Server-side** — the registry runs its own authoritative scan when the upload completes. Findings reject the publish with a `422` and are shown to you; the version is never created.

## What the agent can't do at all

Some actions are deliberately **not** available through the agent interface:

* **Archiving a skill org-wide** (`unpublish`) — removing something from the whole team is a human decision, made in the CLI or the panel.
* **Logging in** — device authorization requires your browser; the agent can only tell you to run `masterskills login`.

## Verifiable, not just promised

The client enforcing these rules is MIT open source — [masterskills-dev/masterskills](https://github.com/masterskills-dev/masterskills). Downloads are verified against their recorded content hash before a single file is written, and every sensitive action lands in the organization's [audit log](/panel/settings-and-audit).