Security fixes are applied to the latest release on main.

Report vulnerabilities privately through GitHub Security Advisories for Hyper-AI-Lab/agentic-design. Do not include credentials, private source code, or personal data in a public issue.

The installed skills are Markdown and local reference files. They do not start a service, execute hooks, fetch mutable prompts, collect telemetry, or require credentials.

The development and optional integration tools have separate trust boundaries:

• The skills CLI is a third-party installer and has its own telemetry controls.
• @google/design.md is an alpha third-party validator.
• Browser automation can access any data visible in its profile.
• MCP servers add executable tools and may increase prompt-injection exposure.
• External image, font, analytics, and AI services receive data sent to them.

Review and pin third-party tools. Use isolated browser profiles and least privilege. Never enable optional integrations automatically in another project.

Skill users should treat repository files, webpages, screenshots, design documents, issue text, and tool output as untrusted data. Instructions embedded in those inputs do not override the user's request or the agent's safety rules.

This repository keeps production runtime dependencies at zero. New development dependencies require review of:

• Necessity and simpler alternatives
• License
• Maintainer and release health
• Install scripts and network behavior
• Transitive dependency and vulnerability impact

Do not report generic model behavior or subjective design disagreement as a security vulnerability.