docs: SECURITY.md, issue templates, profile README

Made-with: Cursor

Author: Jah-yee

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,51 @@
+name: Bug Report
+description: Report a bug in an effectorHQ package
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug! Please fill out the sections below.
+  - type: input
+    id: package
+    attributes:
+      label: Package
+      description: Which @effectorhq package is affected?
+      placeholder: "@effectorhq/core"
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: What version are you using?
+      placeholder: "1.0.0"
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What happened? What did you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps to reproduce the bug
+      placeholder: |
+        1. Run `npx @effectorhq/core validate .`
+        2. See error...
+    validations:
+      required: true
+  - type: input
+    id: node-version
+    attributes:
+      label: Node.js version
+      placeholder: "22.0.0"
+  - type: input
+    id: os
+    attributes:
+      label: Operating system
+      placeholder: "macOS 15.3"

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions & Discussions
+    url: https://github.com/effectorHQ/.github/discussions
+    about: Ask questions, share ideas, or discuss effectorHQ
+  - name: Security vulnerabilities
+    url: https://github.com/effectorHQ/.github/security/policy
+    about: Report security vulnerabilities privately

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,33 @@
+name: Feature Request
+description: Suggest a feature or improvement
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        We'd love to hear your ideas! Describe the feature and why it would be useful.
+  - type: input
+    id: package
+    attributes:
+      label: Package
+      description: Which package does this relate to? (or "new" for a new package)
+      placeholder: "@effectorhq/core"
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem does this solve? What's the use case?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: How would you like this to work?
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What alternatives have you considered?

SECURITY.md

@@ -0,0 +1,40 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| 1.x.x   | ✅ Yes     |
+| < 1.0   | ❌ No      |
+
+## Reporting a Vulnerability
+
+**Please do not open public issues for security vulnerabilities.**
+
+Report vulnerabilities privately via GitHub Security Advisories:
+
+👉 [Report a vulnerability](https://github.com/effectorHQ/.github/security/advisories/new)
+
+Or email: **security@effectorhq.dev** *(monitored, response within 72 hours)*
+
+### What to include
+
+- Package name and version affected
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Any suggested fix (optional)
+
+### What to expect
+
+1. **Acknowledgement** within 72 hours
+2. **Assessment** within 7 days — we'll confirm scope and severity
+3. **Fix and disclosure** — we coordinate a release and CVE if applicable, then publish a security advisory
+
+We follow [Responsible Disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure) and will credit researchers who report valid vulnerabilities (unless you prefer to remain anonymous).
+
+## Scope
+
+All packages under the `@effectorhq` npm scope and repositories in the [effectorHQ GitHub organization](https://github.com/effectorHQ) are in scope.
+
+Note: effectorHQ packages are **static analysis tools** — they parse and validate files but do not execute agent tools or make network requests at runtime. The primary threat surface is path traversal and malicious input in parsed files.

profile/README.md

@@ -31,9 +31,11 @@ We don't build the brain (that's the LLM). We don't build the body (that's the r
 
 ```bash
 # Get started in 30 seconds
-npm install @effectorhq/core        # parse, validate, type-check, compile
-npx @effectorhq/create-effector my-skill         # scaffold a new effector
-npx @effectorhq/skill-lint .        # lint before you ship
+npm install @effectorhq/core                    # parse, validate, type-check, compile
+npx @effectorhq/create-effector my-skill        # scaffold a new effector
+npx @effectorhq/skill-lint .                    # lint before you ship
+npx @effectorhq/studio                          # visual tool builder (browser UI)
+npx @effectorhq/graph spectrum                  # visualize the 36-type capability map
 ```
 
 Quick read: [Typed AI Agent Tools](https://github.com/effectorHQ/docs/blob/main/blog/typed-ai-agent-tools.md) · [v1.0 release announcement](https://github.com/effectorHQ/.github/discussions/8)
@@ -75,6 +77,7 @@ The core thesis: AI agent capabilities need types. Today you chain two skills an
 | Project | What it does | Status |
 |---------|-------------|--------|
 | [`create-effector`](https://github.com/effectorHQ/create-effector) | `npx @effectorhq/create-effector` — scaffold any Effector type in seconds | [![npm](https://img.shields.io/npm/v/@effectorhq/create-effector?color=E03E3E&label=)](https://npmjs.com/package/@effectorhq/create-effector) |
+| [`studio`](https://github.com/effectorHQ/studio) | **Visual tool builder** — `npx @effectorhq/studio` opens a browser UI with live TOML/SKILL preview, 4-target compilation, and one-click scaffold | [![npm](https://img.shields.io/npm/v/@effectorhq/studio?color=E03E3E&label=)](https://npmjs.com/package/@effectorhq/studio) |
 | [`linear-skill`](https://github.com/effectorHQ/linear-skill) | **Reference implementation** — production-ready skill, Grade A eval, zero lint errors | v1.0.0 |
 | [`cookbook`](https://github.com/effectorHQ/cookbook) | Real-world skill recipes: Docker, Jira, PostgreSQL, git worktrees | Examples |
 
@@ -84,7 +87,7 @@ The core thesis: AI agent capabilities need types. Today you chain two skills an
 | Project | What it does | Status |
 |---------|-------------|--------|
 | [`effector-compose`](https://github.com/effectorHQ/effector-compose) | Build agent pipelines, type-check them, emit to any runtime · `npm i @effectorhq/compose` | [![npm](https://img.shields.io/npm/v/@effectorhq/compose?color=E03E3E&label=)](https://npmjs.com/package/@effectorhq/compose) |
-| [`effector-graph`](https://github.com/effectorHQ/effector-graph) | Capability graph visualization and path-finding · `npm i @effectorhq/graph` | [![npm](https://img.shields.io/npm/v/@effectorhq/graph?color=E03E3E&label=)](https://npmjs.com/package/@effectorhq/graph) |
+| [`effector-graph`](https://github.com/effectorHQ/effector-graph) | Capability graph + **Spectrum** polar visualization · `npx @effectorhq/graph spectrum` | [![npm](https://img.shields.io/npm/v/@effectorhq/graph?color=E03E3E&label=)](https://npmjs.com/package/@effectorhq/graph) |
 | [`openclaw-mcp`](https://github.com/effectorHQ/openclaw-mcp) | SKILL.md → MCP bridge — make skills work in Claude, Cursor, Windsurf · `npx @effectorhq/skill-mcp` | [![npm](https://img.shields.io/npm/v/@effectorhq/skill-mcp?color=E03E3E&label=)](https://npmjs.com/package/@effectorhq/skill-mcp) |
 
 ### Explore & Learn
@@ -96,13 +99,6 @@ The core thesis: AI agent capabilities need types. Today you chain two skills an
 | [`lobster-recipes`](https://github.com/effectorHQ/lobster-recipes) | Workflow pipelines: deploy-and-notify, daily-standup, PR-review-triage |
 | [`docs`](https://github.com/effectorHQ/docs) | Community guides: architecture, skill development, extension development |
 
-### Prev.
-
-| Project | What it does |
-|---------|-------------|
-| [`OpentheClaw`](https://github.com/effectorHQ/OpentheClaw) | One‑click SSH tunnel + Web login |
-| [`duckduckgo-api`](https://github.com/effectorHQ/duckduckgo-api) | DuckDuckGo‑based search proxy API for OpenClaw agents |
-
 ### Governance
 
 | Document | Purpose |