Use GitHub private vulnerability reporting. Include the affected plugin and commit, reproduction steps, potential impact, and a minimal example with credentials removed.

Keep undisclosed vulnerability details and credentials out of public issues and pull requests. Reports are reviewed by the repository maintainers; no response-time guarantee is offered.

The supported catalog is the current main branch. Security fixes are delivered through that branch and become available to clients on their next successful source sync.

Skills are instructions executed by an agent using its available tools and permissions. Review their contents and dependencies before installation. Connector authentication is managed by the host application and the connector provider. This repository contains no authentication credentials.