# Security

This plugin only rewrites user-typed `/skill-name` tokens against the session skill catalog.

- It does not fetch remote skill bodies itself. Official `dsh-tool-skill` still loads the matching skill.
- Ambiguous substrings are not rewritten.
- Installing any DSH plugin runs third-party code with the host's permissions. Read the source before you install.