Security fixes are applied to the latest state of main. Older tags are not patched; please update before reporting an issue against an outdated version.

Please report security issues privately rather than in a public issue.

1. Open a private security advisory for this repository (preferred — private vulnerability reporting is enabled), or
2. email Pthahnix@proton.me with the details.

Include the affected path, a description of the impact, and the steps needed to reproduce it. Please do not disclose the issue publicly until a fix is available.

• Acknowledgement within 5 business days.
• An initial assessment, including severity and a remediation plan, within 10 business days.
• Credit in the release notes once a fix ships, unless you prefer to remain anonymous.

This repository ships no executable code. It is 271 markdown skills plus the repository's own automation, so the attack surface is what a skill body tells an agent to do. In scope:

• any skill that instructs an agent to execute commands, write files, delete data, or reach external services;
• prompt injection carried in a skill body — text that redirects an agent away from the contract the skill states;
• repository automation under .github/.

Out of scope: third-party MCP servers, including any listed as recommendations in the README, and issues in the AI models or harnesses that execute these skills. Please report those to their respective maintainers.

We will not pursue action against researchers who report issues in good faith, avoid privacy violations and data destruction, and give us reasonable time to respond before any public disclosure.