Security
What happens to your team’s text
Where your skills are kept, who reads them, and what SkillKeeper can and cannot see. Nothing is used to train anything.
The check
Every skill is read before it spreads
A skill is text an AI obeys. Before one is shared with the team or sent outside, the check reads every file as text: hidden text and invisible characters, instructions aimed at the model, secrets, links that reach out. Then Claude reads it for what rules cannot see. It never runs the content.
Outcomes are pass, notes or refused. Nothing leaves on an unfinished check, and a person decides on what the check flags. A skill that passes is checked, with a date. No tool can promise more than that.
How we checkWhere data lives
Your library is your files
Your published library
your company’s private GitHub
Plain SKILL.md folders in a repository that belongs to the company, or one SkillKeeper hosts for you. Claude syncs from there. If you stop using SkillKeeper, the files stay where they are.
The app
Supabase · us-east-1
Drafts, versions, reviews and members. Every table is locked per workspace, and nothing is written from the browser. A content security policy is in force, and errors are watched with Sentry.
What Claude sees
Anthropic’s API
Claude reads each skill once as part of the check, and drafts merges and pasted skills when someone asks it to.
What OpenAI sees
OpenAI’s API
To spot duplicates, a skill’s description and the first 1,500 characters of its text are turned into numbers by OpenAI’s embedding model. Never account data, and not used to train anything.
What SkillKeeper sees of use
connector calls only
Which skills Claude fetched through the SkillKeeper connector, by person and by skill. We do not see how skills are used inside Claude.
Who sees what
Private until you share
only you
Every skill starts as a private draft, however it arrived. Nothing unshared appears in anyone else’s library, in review, or in usage.
workspace
Shared skills are visible to the team. Leads review them; the owner can withdraw until a lead acts.
everyone’s Claude
Approved skills, after a lead publishes them.
outside
Only a copy someone chose to send, to the addresses they typed. The recipient reads it before accepting, and the send is logged.
Sign-in
Two-step, by workspace rule
People sign in by emailed link, Google or Microsoft, with a password if they want one. Two-step sign-in is available to everyone, and each workspace can require it of its leads or of everyone.
Leads see whether each person’s Claude is connected and when it last called.
For your review
The documents