Report vulnerabilities privately through GitHub Security Advisories for the repository. Do not include live secrets or personal data in reports or fixtures. Maintainers will acknowledge reports when capacity permits; this draft project makes no response-time guarantee.

skill-score evaluates supplied assessment facts. It is not a sandbox, malware detector, secret scanner, signature verifier, or security certification. Run untrusted .skill artifacts only in appropriately isolated environments.