This repository publishes four AI agent skills — Markdown instruction files plus dependency-free .sh/.ps1 helper scripts (no compiled code, binaries, or network access) — and, separately, optional Node.js guard hooks in integrations/ and Docker lab templates (compose files, bootstrap scripts) that skills write into a project only after approval. Security concerns relate primarily to:

• Instruction integrity — guidance should not be misleading, exploitable, or harmful
• Content accuracy — risk analysis, security assessment, and behavioral frameworks should reflect current best practices
• Script and template safety — helper scripts, guard hooks, and lab templates must not leak secrets, bypass the approval gate, or run more than they declare

If you find a security issue in any skill in this repository — including harmful, misleading, or exploitable guidance — please do not open a public issue.

Report it privately by:

1. GitHub Security Advisories (preferred): Report a vulnerability
2. Email: m@carrillo.app

• The affected skill and file(s)
• A description of the issue
• Why this is a security concern (e.g., guidance that could lead a user to introduce a vulnerability, or AI instruction that could be exploited via prompt injection)
• A suggested correction if you have one

• Opinions about whether a given risk rating is too high or too low → use a regular issue
• Suggestions to add new analysis domains, frameworks, or rules → use a feature request
• Markdown rendering issues → use a regular issue

Thank you for helping keep these skills accurate and trustworthy.