Report security vulnerabilities via GitHub Security Advisories. Do not use issues or email.
Only the latest release on the main branch receives security updates.
This repository ships a single methodology skill file (skills/zola/SKILL.md) and its supporting workflow/reference markdown files. No runtime scripts, binaries, or dependencies are shipped. Security concerns for this repo are limited to:
- Malicious modifications to the skill methodology that could mislead users into unsafe practices
- Supply chain integrity of the skill payload itself (the markdown files under
skills/zola/)
This repo does not contain:
- Credentials, secrets, or API keys
- Test fixtures with sensitive data
- Runtime code that executes on user machines
- Network-facing services
- Public (GitHub Security Advisory): Preferred for all vulnerability reports. The advisory will be published after triage.
- Private: Not required for this repo since no sensitive infrastructure or user data is involved.
The runtime payload is the skills/zola/ directory containing:
- 1 SKILL.md frontmatter + markdown body
- 6 workflow markdown files
- 6 reference markdown files
Total: 13 markdown files, ~150KB. No scripts, no config files, no dependencies. Users copy only skills/zola/ to their agent's skill directory.
Last reviewed: 2026-09-06.
This repository has no CI workflow at present. Before a release, follow the
manual checks in docs/release-checklist.md:
validate the skill with skills-ref, run bash tests/run.sh, and perform the
published-package smoke matrix. Revisit automation only if the documented
manual process becomes a demonstrated maintenance bottleneck.