Skill Scout is a security-first skill manager for Claude Code. Security issues in a tool that audits other tools are especially important to us.

Please report vulnerabilities privately through GitHub Security Advisories on this repository ("Security" tab → "Report a vulnerability") rather than in a public issue. If the repository is not yet published or advisories are unavailable, open a minimal public issue that says only "security report, please contact me" without details.

Include, where possible:

• the affected file(s) and version/commit;
• a description of the issue and its impact;
• reproduction steps that do not require executing untrusted code.

You can expect an acknowledgement within 7 days. This is a single-author project; fixes are best-effort but security reports take priority over all other work.

Reports of the following are in scope:

• A way to make the install skill write files without the exact INSTALL <plan-id> confirmation, or outside the planned destination.
• A way for a candidate skill (untrusted data) to change the behavior of the recommend, audit, or install workflows — prompt injection that survives the trust model.
• A fixture or example in this repository that is actually executable or contacts a real network endpoint (all fixtures must be inert and use the reserved domain example.invalid).
• Weakening of Claude Code permission prompts by any part of this plugin.

These are disclosed by design in docs/limitations.md and the README; reporting them again is not necessary:

• The Plan ID confirmation gate is a model instruction, not a runtime guarantee. Claude Code has no mechanism that would forcibly stop an installation if the model deviates from the instruction. The gate raises the bar; it is not an enforcement boundary.
• A model-based audit cannot prove software is safe. NO-BLOCKER-FOUND means "no blocker found in the inspected files", never "safe".
• Skill-level disallowed-tools and agent tool allowlists restrict tools, but they do not create filesystem-level sandbox guarantees.

tests/fixtures/ deliberately contains dangerous-looking, inert examples (prompt injection, exfiltration patterns, destructive hooks) used only as data for the auditor. Never execute them. See tests/README.md.