These skills instruct AI agents and may ship shell scripts. If you find something that could cause an agent to take an unsafe action — destructive shell commands, prompt-injection vectors, exfiltration of local files — please report it.

Use GitHub's private Report a vulnerability flow rather than a public issue. Include the skill name, the risky instruction or script, and a minimal reproduction.

You'll get an acknowledgement within a few days. Fixes ship as a normal commit with credit in the release notes unless you prefer to stay anonymous.