Skip to content

Security: OpenGHz/npx-skill-install

Security

SECURITY.md

Security Policy

Supported Versions

This project tracks its latest release on the main branch. Security fixes are applied to the latest version.

Version Supported
latest (main)

Reporting a Vulnerability

If you discover a security issue, please do not open a public issue. Instead, use GitHub's private vulnerability reporting:

  1. Go to the repository's Security tab → Report a vulnerability, or
  2. Contact the repository owner privately.

Please include steps to reproduce and the potential impact. We aim to acknowledge reports within a few days and will keep you informed of the fix progress.

Scope notes

The bundled scripts run shell commands and create symlinks under your home directory. check-skills-setup.sh is read-only. setup-symlinks.sh modifies agent skills directories but never deletes data (it backs up real directories before linking). Review the scripts before running them in sensitive environments.

There aren't any published security advisories