Acceptable use policy

This policy applies to everyone who uses CoreSkill: the organization that runs a business, every person invited into it, and every AI assistant or integration connected with a key. It forms part of the Terms of service, so breaking it is a breach of the agreement with Core Skill. The Customer is responsible for the conduct of its Users and of the keys it issues.

1. The principle behind every rule

Use CoreSkill to distribute your own working instructions to your own people. Everything forbidden below is a variation on using it for somebody else's data, somebody else's systems, or somebody else's harm. If you are unsure whether something is allowed, write to [email protected] before you do it.

2. Prohibited content

• Anything unlawful under the law of Core Skill, or under the law of the place where you or your people use the Service or act on its content.
• Content that infringes copyright, trademark, trade secret, privacy or any other right of a third party, including another company's confidential manuals or licensed material you are not permitted to redistribute.
• Malware, exploit code, or instructions whose purpose is to compromise a system you are not authorized to test.
• Instructions designed to make an AI assistant deceive, defraud or manipulate people, including fake reviews, impersonation, phishing, or forged official documents.
• Content that harasses, threatens, defames, or incites violence or hatred against a person or group.
• Sexual content involving minors, in any form and for any reason. It will be removed and reported to the competent authorities.
• Content that promotes terrorism, violent extremism, human trafficking or the sale of illegal goods.
• Special categories of personal data, such as health, biometric, political or religious data about identifiable people, unless you have a lawful basis and the Data processing addendum applies.

3. Prohibited conduct

• Attempting to reach a business, department, server or skill you were not given access to, whether through the interface, the API or by guessing identifiers.
• Using a key that is not yours, or attempting to derive, guess or brute-force keys.
• Circumventing security, limits or plan restrictions, including rate limits, quotas, skill protection settings, suspensions or plan expiry, for example by rotating IP addresses or creating extra accounts or businesses for the purpose.
• Probing, scanning, load testing or attacking the Service, its infrastructure or other customers, except as allowed in section 7.
• Interfering with logging. The MCP log is how an organization sees who read which skill. Suppressing, forging or flooding it is a serious breach.
• Sending spam or unsolicited messages through the Service, including mass invitations or key emails to people who have no working relationship with your organization.
• Reverse engineering, decompiling or copying the software, except to the extent the law expressly permits it regardless of this restriction.
• Reselling, sublicensing or offering the Service to third parties, or building a competing product with it, without a written agreement with Core Skill.
• Using the Service in violation of export control or sanctions laws, or on behalf of a person subject to such sanctions.

4. Keys

• One key, one person. A key is issued for an individual in your organization. Do not share a key with anyone outside your organization, and do not let several people use one key: a shared key makes the log say something untrue about who did what.
• Do not issue a key on somebody else's behalf and keep it. Every call it makes will carry that person's name.
• Do not publish a key in a repository, ticket, chat channel or screenshot. Treat a leaked key like a leaked password: revoke first, investigate second.
• Revoke the keys of anyone who leaves your organization or no longer needs access.
• Do not use a key after your access has been withdrawn, even if it still works for a moment.

5. Fair use of resources

The system enforces limits such as those below, and your plan may set lower ones. They exist so that one customer cannot degrade the Service for everyone. If your legitimate use needs more, ask at [email protected] instead of working around them.

6. Automated access and extraction

Connecting AI assistants and scripts that read skills to do your own work is what the Service is for. What is not allowed is systematically downloading skills in order to store them elsewhere, resell them, publish them or feed them into another product, or scraping any part of the Service beyond what your authorized use requires. The test is purpose, not speed.

7. Security research

• Testing is welcome against your own business, with your own accounts and keys.
• Do not test against another customer's data, and stop the moment you reach data that is not yours.
• No denial of service, load testing or high-volume automated scanning.
• Do not exfiltrate, modify or delete data to prove a finding.
• Report first, publish later, giving Core Skill a reasonable time to fix the issue.

8. Enforcement

1. 1A warning to the Owner, with what was found and what must change.
2. 2Removal or disabling of the content, or revocation of the keys involved.
3. 3Suspension of the account or business, which cuts off every key in it at once.
4. 4Termination, and where the law requires it, a report to the competent authorities.

Core Skill normally works through these steps in order and states the reason, unless the law or an active investigation prevents it. Where a breach creates an immediate risk to other customers, to the security of the Service, or to a person's safety, Core Skill may act at once and explain afterwards. Core Skill has no obligation to monitor content, but may investigate reported or suspected breaches.

9. Reporting abuse

If you believe someone is using CoreSkill in breach of this policy, write to [email protected] with what you saw, where and when. Reports about personal data go to [email protected]. Reports are handled confidentially.

10. Changes and contact

This policy may be updated as new kinds of misuse appear, with notice as described in the Terms of service. The current version is always the one on this page. Questions go to [email protected], or by post to Core Skill, coreskill.app. This policy takes effect on 22/9/2026.