Report security issues privately through GitHub: open this repository's Security tab and choose Report a vulnerability. Do not open a public issue.

The plugin's hooks and scripts run locally with your user account's permissions, and an update replaces them. See "What runs on your machine" in README.md for each hook, what it reads, what it can change, and the only network requests it makes.

Fixes go into the latest release only. Update with claude plugin update.