Report security vulnerabilities via GitHub Security Advisories. Do not use issues or email.

Only the latest immutable release tag and the current main branch receive security updates.

This repository ships a single methodology skill file (skills/zola/SKILL.md) and its supporting workflow/reference markdown files. No runtime scripts, binaries, or dependencies are shipped. Security concerns for this repo are limited to:

• Malicious modifications to the skill methodology that could mislead users into unsafe practices
• Supply chain integrity of the skill payload itself (the markdown files under skills/zola/)

This repo does not contain:

• Credentials, secrets, or API keys
• Test fixtures with sensitive data
• Runtime code that executes on user machines
• Network-facing services

• Public (GitHub Security Advisory): Preferred for all vulnerability reports. The advisory will be published after triage.
• Private: Not required for this repo since no sensitive infrastructure or user data is involved.

The runtime payload is the skills/zola/ directory containing:

• 1 SKILL.md frontmatter + markdown body
• 6 workflow markdown files
• 6 reference markdown files

Total: 13 markdown files, ~60KB. No scripts, no config files, no dependencies. Users copy only skills/zola/ to their agent's skill directory.

Last reviewed: 2026-10-13.

The commit-message workflow checks the what:/why: record on pull requests and pushes to main. Before a release, follow the manual checks in docs/release-checklist.md: validate the skill with skills-ref, run bash tests/run.sh, and perform the published-package smoke matrix.