To report a vulnerability, email hello@theopenapps.com. Please don't open a public issue for it. Include the skill or file, what an attacker could do, and how to reproduce it.

These skills read store data from OpenApps. Store listings are written by their publishers, so the skills tell the agent to read listing text as data and never follow instructions inside it.