Security fixes are applied to the latest tagged release and the default branch.

Use GitHub's private vulnerability reporting for this repository when available. Include:

• the affected release or commit;
• the exact file and behavior;
• a minimal, non-destructive reproduction;
• the data, credential, permission, or external system at risk;
• a suggested mitigation, if known.

Do not place real credentials, private user data, or active exploit payloads in a public issue. If private reporting is unavailable, open a public issue containing only a request for a private contact channel.

Agent Skills are instructions plus optional executable resources. Treat changes to instructions, scripts, install behavior, external reads, permissions, and approval gates as security-sensitive.

The project will not intentionally add:

• credential harvesting or hidden secret access;
• prompt or usage telemetry;
• obfuscated or dynamically downloaded execution;
• silent installation or overwrite behavior;
• external publishing, account changes, purchases, deletion, or other writes without explicit user approval.