scripteratops ships skill templates — source you copy into your own tools. It runs no service and holds no user data. The most relevant concerns are therefore issues in a template that could lead a generated tool to be insecure (e.g. a subprocess or config-parsing pattern that mishandles untrusted input).

Please report privately — do not open a public issue for a security problem.

Use GitHub's private vulnerability reporting: go to the repository's Security tab → Report a vulnerability. This opens a private advisory visible only to the maintainers.

Include: the affected skill/template, the version or commit, what an attacker could do, and steps to reproduce if you have them.

• Acknowledgement of your report within a reasonable time.
• An assessment of severity and scope.
• A fix (or a documented mitigation) and, if you wish, credit in the release notes.

Thank you for helping keep the project and its users safe.