Please report security issues responsibly so we can address them before public disclosure.

• Email: security@jfrog.com or follow the process described on JFrog's security page.

Include steps to reproduce, affected versions or commits, and impact if known.

This repository ships an OpenCode plugin (a thin config hook plus vendored skills, published to npm).

Do not commit secrets, API keys, or credentials. Skill runtime data under **/local-cache/ must not be checked into git.