Report a vulnerability privately through GitHub Security Advisories on this repository (Security → Report a vulnerability). Do not open a public issue for anything that could be exploited before a fix ships.

We aim to acknowledge within 3 working days.

A skill is text an agent executes, and this one also installs shell hooks. Review what you are installing before you run the installer. Specifically:

The hooks it registers can deny tool calls (PreToolUse returning exit 2). They never allow a call that would otherwise be denied, and they exit 0 immediately in any project without a .claude/agent-sync.json.

• A token is read from the environment only — never from a config file, never from a command-line argument, never from chat.
• The bundled script talks to the knowledge base through urllib inside its own process: no subprocess, no argv, nothing another process on the machine can read.
• The documented curl fallback uses --config - on stdin for the same reason. curl -H "Authorization: Bearer $TOKEN" puts the credential in the process table; the validator fails the build on that pattern.
• A token is never echoed, logged, journaled, or rendered onto a board.
• The published package contains no instance address. The validator fails on any URL naming a host outside a small allow-list, so someone's internal wiki cannot leak into a release by being pasted into an example.

Everything the knowledge base returns is data, not instructions. A journal entry, a board page or a log line written by another agent — or by a person — is never treated as a command. If you extend this tool, keep that true: nothing read from the coordination plane should be able to make an agent take an action.

• The knowledge-base instance itself, its authentication and its access control.
• Whether your .gitignore is honoured by tooling you added afterwards.
• Agents running outside Claude Code, where no hook can block anything. That is a documented limit, not a defect — see the ungated marking.