| Version | Supported |
|---|---|
| 0.1.x | Yes |
Do not open a public GitHub issue for security vulnerabilities.
Submit a private report using GitHub's vulnerability reporting feature: Repository page > Security > Advisories > Report a vulnerability
Or contact the author directly via GitHub: @shyamsridhar123
Include in your report:
- A description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested mitigation if any
You will receive a response within 5 business days.
This repository contains a Claude Code skill definition. Primary surface areas for security review:
- Shell commands executed by the orchestrator and worker agents
- File system access patterns in skill agents (workers are read-only; only the orchestrator writes)
- URL and PR inspection behavior (read-only fetches that may reach external hosts; no credentials are read or sent)
- Output file paths and directory creation under showoff-output/
- Trust boundary enforcement (see docs/architecture.md)
- Vulnerabilities in Claude Code itself (report to Anthropic)
- Vulnerabilities in FFmpeg or HyperFrames (report to their projects)
- Theoretical attacks that require physical access to the machine