| Version | Status |
|---|---|
| 0.x | Active development — security fixes applied |
Do not report security issues via public GitHub Issues.
Use GitHub Private Vulnerability Reporting to submit reports.
Include:
- Description and impact
- Reproduction steps
- Affected versions
- Suggested fix (if any)
| Stage | Time |
|---|---|
| Acknowledgment | 48 hours |
| Initial assessment | 5 business days |
| Fix (Critical) | 7 business days |
| Fix (High) | 14 business days |
| Fix (Medium/Low) | Next regular release |
The following are in-scope for HarnessForge:
- SKILL.md descriptions containing hidden instructions that manipulate agent behavior
- Reference files containing instruction-override payloads
- Templates in
references/that inject harmful code when expanded by agents - {{PLACEHOLDER}} patterns designed to trick agents into unsafe operations
- Malicious modifications to plugin.json that alter skill discovery paths
- Path traversal in manifest
skillsfield
- Compromised dependencies (if any are added in future)
- Malicious modifications to plugin.json manifests
- Vulnerabilities in Claude Code, Codex, or other agent platforms themselves
- User misconfiguration of installed skills
- Social engineering attacks
We thank all researchers who report security issues responsibly. Credits are included in CHANGELOG.md after fixes ship (unless anonymity is requested).