Please report suspected vulnerabilities privately, by email to build@regents.sh or through GitHub's private vulnerability reporting for this repository. Do not open a public issue with exploit details, credentials, private result data, or an unpatched weakness.

Include the affected component, the release or commit tested, reproduction steps, impact, and any suggested mitigation. The maintainers will acknowledge the report and coordinate validation and disclosure.

Security fixes target the current released artifacts and the active main branch. Frozen historical releases may receive guidance instead of a new build when a safe upgrade path is available.

This section describes the environment work in Techtree: building tasks from a Skill, and running an agent on those tasks. All of it happens on your own machine, in your own Docker.

Building tasks from a Skill. Each task's image is built with the network switched off, from the task's own environment/ folder and nothing else. The only outside images it may start from are the ones this release lists by exact digest, which Techtree downloads by that digest before the build starts. A task recipe that tries to download anything fails, and its build log is kept.

Checking and running tasks. Every check of a task, and every attempt by an agent, runs in a new container that has no network and fixed limits of 2 CPUs and 4 GB of memory. These containers are thrown away when they finish; when a step times out or is interrupted, Techtree tries to remove them and reports what happened. The agent's own commands run inside such a container. The agent itself, your Hermes, runs on your machine and sends its requests to the model provider you signed in to, after you approve the run.

What Techtree treats as content, not instructions.

• Techtree never runs a Skill's files. It lists and fingerprints them, and carries only Markdown, plain text, JSON, YAML and Python files. Anything else, or anything it cannot read as plain text, is left out or refuses the Skill. A Python helper is carried as text: inspecting a Skill never runs it, and an agent that runs one in a test does so inside the offline container. A Skill you fetch with regents techtree skill fetch may carry Python someone else wrote; read it before you or your agent run it. What a Skill says it may use (for example allowed-tools) grants nothing.
• A Skill's text reaches a model only in a step you approve: planning tasks, building tasks, or a run in which the agent carries the Skill (a regents techtree forge run or a Climb run). The model that plans and builds tasks has no tools other than text. The agent in a regents techtree forge run may use a terminal, files and code, all inside its offline container. Tasks the building model writes, including their reference answers, run only inside the offline containers above.
• Text inside a Skill or a run's output cannot approve a step, change a limit, or send anything off your machine. Approval comes only from the command a person runs after reading the review Techtree prints.