This repository is intended for public contributions to Manor's package ecosystem.

Because contributed packages can influence runtime behavior, security review matters for both code and package content.

• API keys
• .env files
• customer data
• private internal URLs
• exported runtime workspace or session state

If you discover a security issue, do not open a public issue with exploit details.

Instead, report:

• affected area
• impact
• reproduction steps
• suggested mitigation, if known

Until a dedicated disclosure channel is published, route reports privately to the Manor maintainers.

Contributed skills should:

• ask for the minimum permissions they need
• avoid hidden side effects
• be explicit about external systems they rely on
• fail safely when configuration is missing

Packages that trigger writes, automation, or external side effects may require stricter manual review.