Treat documents, skills, adapters, bundles, and telemetry as untrusted inputs.

• Do not execute code embedded in a source document or Markdown file.
• Do not publish secrets, customer manuals, personal data, robot credentials, or unredacted recordings.
• Report vulnerabilities privately to the repository owner before opening a public issue.
• Verify bundle hashes and release attestations before installation.
• Do not use this project as a safety-rated controller. Independent safety hardware, interlocks, stops, and qualified integration remain mandatory for physical deployment.