Please use GitHub private vulnerability reporting. Do not open a public issue for a suspected vulnerability.

Include only the minimum information needed to reproduce the problem. Never attach credentials, private skill contents, local paths, sidecar data, raw agent output, or screenshots containing private information.

Security fixes are applied to the current main branch. This project does not currently publish supported releases.