Report privately through GitHub Security Advisories, or by Telegram to @sshlg if you'd rather not use GitHub. Please don't open a public issue for something exploitable.

Expect an acknowledgement within a few days. This is a small project maintained by one person — there is no bounty, but you'll be credited in the release notes unless you'd prefer otherwise.

make-skill ships Markdown plus two small installers. Knowing exactly what runs where is most of the threat model:

• bin/make-skill.js (run via npx) and install.sh copy files into ~/.claude/skills/make-skill and ~/.claude/commands/. They create and overwrite only those paths, never elsewhere in $HOME, and overwrite only with --force. Both are zero-dependency: no network calls, no postinstall script.
• test/validate.py reads repository files and exits with a status. It writes nothing.
• The Claude Code plugin and the skills CLI channels are handled by those tools, not by code in this repo.

Nothing here asks for credentials, and nothing phones home. The npm package has no dependencies, so its supply-chain surface is npm itself.

A skill is text that a coding agent loads into its context and follows. Two consequences worth stating plainly:

• Review a skill before installing it, from any source including this one. Prose that an agent treats as instruction deserves the same scrutiny as code you would run.
• The canon in this repo deliberately tells agents to treat everything coming back from an MCP server or an A2A peer as untrusted data, never instructions, and never to auto-approve tool calls or bypass consent prompts. If you find guidance here that contradicts that, it is a bug — please report it.

The latest release on main is supported. Fixes go into a new version rather than being backported.