Please use GitHub's private vulnerability reporting for this repository when possible from the repository's Security tab.

If private reporting is unavailable to you, contact the maintainer privately before disclosing details publicly.

Do not report security issues in public GitHub issues, pull requests, discussions, or commit messages.

• Affected skill or file path
• Clear reproduction steps
• Impact assessment
• Suggested remediation, if you have one

• Initial acknowledgement: within 5 business days
• Triage update: within 10 business days
• Fix timing: depends on severity and release impact