v0.6.3

0.6.3 (2026-10-07)

Bug Fixes

• hooks: gate builtin-named local skills, reject path-like names, fail closed on errors (#387) (891db50)
• rules: an all-composite reports every first-branch match, so suppress is per line (#403) (e5ef4fd)
• rules: narrow SG-SEC-001 — "Local Storage" counts only in path form (#393) (567e04b)
• rules: SG-INJ-011 tells a device-code login from ClickFix by where the text goes (#402) (89977f4)
• skill: reject named pipes and other non-regular files instead of blocking on them (#397) (2dbc63e)