SECURITY.md

# Security

This release adds no MCP server, connected app, authentication flow, external
write tool, or executable runtime script. Live research and file analysis rely
on tools and permissions already provided by the host assistant.

The skill distinguishes source content from instructions, uses de-identified
public queries, minimizes identifiers in summaries, and does not authorize
filing, signing, messaging, or uploading records merely because it can prepare
a draft. These are behavior instructions, not a technical sandbox or guarantee
about the host's capabilities.

For a reported issue, provide a minimal redacted example and plugin version.
Do not post claim records, passwords, or personal identifiers publicly. No
publisher security contact is asserted by this package.