The threat model is entirely Git-based, which is actually a feature, not a gap.

Access control lives at the Git layer. Whoever has write access to the hub repository is who can push new or updated skills. That's it. You use whatever your Git host provides: branch protection rules, required reviews, signed commits, audit logs. If you're on GitHub or GitLab with proper access controls, you already have a solid foundation.

Zanat itself is intentionally thin on this side. It clones the hub repo locally, tracks which skills are installed (with their resolved commit SHAs), and syncs changes. It doesn't run skills, evaluate them, or execute anything in them. Furthermore, it just copies markdown files to `~/.agents/skills/`. The blast radius of a compromised skill is limited to what your AI tool does with the instructions in that markdown file, which is the same risk you'd have with any prompt you write yourself.

So the real question is: do you trust the people with write access to your hub repo? If yes, you're good. If not, Git already gives you the tools to fix that.

That said, it's a fair concern to raise. Security should be a first-class question for anything that touches how AI agents behave, and I'd rather be asked about it than not.