Fleetmind installs and wires together developer tooling and AI agents. That means it runs install scripts, sets PATH, writes config, and installs a git hook. Please treat it with the same care as any bootstrap that touches your machine.

• Installs tools from their official sources (pinned in install/02-tools.sh and gitlab-setup.sh). No third-party mirrors.
• Installs to your user space (~/.local, ~/go/bin, nvm) — no sudo by default.
• Writes a review-gate hook (agent/hooks/review-gate.sh) that blocks direct git push so changes route through the validation pipeline. You can read it; it's ~40 lines.
• Never stores credentials. Authentication (gh, glab, claude) is interactive and handled by those tools' own credential stores.

Fleetmind installs a few agent skills (axi, gh-axi, lavish). Skills can instruct an agent to run commands on your machine. Fleetmind only installs skills from the upstream authors' repos, and the skills CLI prints a security assessment for each at install time. Review skills before use — they run with your agent's permissions. Do not add skills from untrusted sources.

If you find a security issue:

1. Do not open a public issue.
2. Use GitHub's private vulnerability reporting ("Security" tab → "Report a vulnerability") on this repository, or contact the maintainer directly.
3. Include: what you found, how to reproduce it, and the potential impact.

We'll acknowledge within a few days and work with you on a fix and coordinated disclosure.

This is an early-stage project; security fixes land on the latest main. Pin a commit if you need stability, and watch releases for advisories.