Please report vulnerabilities privately to the maintainers.

Do not post unpatched security issues publicly.

Relevant scope:

• skill metadata
• scripts shipped inside skill folders
• documentation that may instruct privileged operations