Please report suspected vulnerabilities privately through https://x1wealth.com/contact and identify the message as an agent-skills security report.

Do not attach financial documents, account data, access tokens, API keys, host transcripts, production receipts, or bearer URLs to a public issue or pull request. Use synthetic examples until X1 provides a private exchange path.

This repository contains client-side workflow instructions and synthetic tests. The live X1 service independently controls authentication, household scope, and tool authority. Installing the skill does not grant additional X1 access.