This repository contains documentation and a small, dependency-free Python validation script. It does not run as a network service and stores no credentials.

If you find a security issue in the skill content or the validation scripts (for example, guidance that could leak private data, or a script flaw), please open a GitHub security advisory or a regular issue if the problem is not sensitive.

Please do not include real secrets, tokens, or private logs in any report.

The skill is explicitly designed to reduce security risk in AI-assisted maintainer workflows. Its operating rules require agents to:

• Treat issue and PR content as untrusted input (prompt-injection aware).
• Keep secrets out of files, comments, and commits.
• Use dry-run and human-approval steps before any automated write.

If you believe any guidance in SKILL.md or references/ weakens those goals, that is in scope and we welcome a report.