# Security Policy

## Reporting a Vulnerability

Skills in this repository are markdown instructions — they do not execute code on their own. However, if a skill contains scripts or references that could pose a security risk:

1. **Do not** open a public issue
2. Email the maintainer or open a draft security advisory on GitHub
3. Describe the risk and which skill(s) are affected

## Best Practices for Users

- Review skill contents before installing — especially `scripts/` directories
- Skills from this repo only read/write files in the wiki directory structure
- Never run skills from unverified sources with elevated permissions
