If you discover a security vulnerability, please report it privately through GitHub Security Advisories.

Do not open a public issue for security vulnerabilities.

When reporting, please include:

• Affected version(s)
• Steps to reproduce or a proof-of-concept
• Description of the impact
• Suggested fix if you have one

We will acknowledge receipt within 7 days and provide a timeline for a fix.

Agent Plugins Builder handles untrusted input from source projects during migration. The following controls are in place:

• Migrated configuration is parsed as data, never executed.
• Suspected credentials in source projects are flagged and not copied into generated output.
• Path containment is enforced: plugin-relative paths must resolve within the plugin root.
• Symlinks that escape the plugin root are rejected.

This policy covers the Agent Plugins Builder CLI, its packages, and generated output. It does not cover third-party agent clients or the Agent Plugins specification itself.