Only the latest release receives security fixes.

Please report vulnerabilities privately via GitHub security advisories rather than opening a public issue. You should receive a response within a week.

• The Skill Atlas UI server (skillroute ui) binds to 127.0.0.1 by default and is intended for local use; do not expose it to untrusted networks.
• The MCP server executes the SkillRoute CLI locally and inherits the permissions of the user running it.