Use GitHub's private vulnerability reporting on this repository
(Security → "Report a vulnerability"), or open an issue if the report is
not sensitive. Reports are read by the maintainer; please include the
engine version (clauderize --version) and, for wiring issues, the output
of clauderize doctor.
Clauderizer writes repo-local files that register commands your agent
harness executes: its MCP server (and, on hook-capable hosts,
SessionStart/UserPromptSubmit hooks). It supports a range of hosts, so the
registration lands in a host-specific config file (e.g. .mcp.json,
.cursor/mcp.json, .vscode/mcp.json) — always as a non-destructive
key-merge that preserves any other servers. One narrow, opt-out-able exception
writes outside the repo: a bespoke auto-write host (e.g. the Kimi Work
desktop, D-053/D-056) that reads MCP only from a per-user config the app owns
gets that one clauderizer key merged into it — detected-only (never creating
the app's dirs), non-destructive, and skipped entirely by
CLAUDERIZER_NO_KIMI_DESKTOP=1.
Two tools read outside the repo when an agent explicitly calls them (never
from a hook, never automatically): cz_discover_skills reads SKILL.md
frontmatter from your local skill directories, and cz_mine_failures reads
your agent-harness session transcripts (by default
~/.claude/projects/<slug>/, overridable with CLAUDERIZER_TRANSCRIPTS_DIR)
and returns excerpts of your own prompts into the agent's context so it can
propose corrections. Both are read-only and nothing leaves your machine, but
anything an agent then records lands in committed markdown — so treat
transcript mining as you would any tool that reads your history.
The full statement of what is
written per host, what executes when, under which contracts, and what
happens when you clone a repo that already carries the wiring lives in
docs/TRUST.md — behavioral claims there that disagree
with the code are treated as bugs. To remove the wiring cleanly, run
clauderize uninstall: it reverses the full footprint (MCP keys, hooks,
marker stanzas, skills, .clauderizer/) with key/marker-scoped removals that
preserve other servers, foreign hooks, and your docs/ memory.
Project skill-awareness adds no execution surface: cz_discover_skills
only reads SKILL.md frontmatter (name + description) from your local skill
directories — it never executes a skill — and proposes what to register;
cz_register_skill / cz_obsolete_skill write only to docs/SKILLS.md. No
network at runtime.
Only the latest released version is supported. The findings
tracker (docs/HARDENING.md) is public and append-only; resolved findings
carry dated evidence.