If you find a vulnerability in SkillHawk itself, please avoid publishing exploit details in a public issue. Use GitHub's private vulnerability reporting feature when enabled, or contact the maintainer privately through the GitHub profile.

SkillHawk is a static heuristic scanner. A clean report does not prove that a skill or MCP server is safe, and a finding does not prove malicious intent. Review flagged behavior in context before executing third-party code.