Skill Assembly is a low-risk local developer tool, not an arbitrary third-party code sandbox.

Its primary safety boundaries are:

• existing Raw Skills are read-only;
• all managed writes stay under resolved Skill Assembly roots or the owned Codex plugin projection;
• Codex hook trust remains an explicit User action;
• unknown data roots and foreign Host projections fail closed;
• upstream corpus scripts are never executed;
• local-data deletion requires an explicit, separate confirmation;
• release artifacts are inspected for personal paths, runtime state, and third-party corpus bytes.

Please report a vulnerability privately through the repository's GitHub security advisory feature. Do not include credentials, private Skills, or personal managed data in an Issue.