Do not disclose vulnerabilities in public issues. Use the repository's private GitHub security-reporting feature or contact the maintainer directly.

Include, when possible:

• a description and impact assessment;
• the affected version or commit;
• minimal reproduction steps;
• a plausible exploitation scenario;
• a suggested mitigation.

Never include personal data, credentials, or third-party artifacts in the report.

Reports are especially relevant when a flaw could:

• cause the skill to recommend unsafe training or deployment;
• bypass containment or promotion gates;
• validate an invalid experiment manifest;
• produce misleading statistical comparisons;
• execute unintended files or commands.

This project provides guidance and utilities. It does not replace a security review of systems built with the skill.