# Security and Trust Review

## Scope

`agent-expert-panel` is primarily an instruction package. It has no runtime service, model credential, browser session, or automatic subagent launcher. The release package contains Markdown, YAML, JSON, text fixtures, and a local read-only validation script.

## Trust boundaries

- Remote Skill content is metadata and guidance only; remote inline execution is forbidden in `agents/interface.yaml`.
- Actual tool calls, delegation, spending, publishing, and data access remain under the host runtime's permission model.
- The Skill requires capability, privacy, budget, and approval preflight before operational routing.
- The validation script reads repository files and reports failures; it does not modify the working tree or access the network.

## Public repository checks

The release gate checks:

- valid Agent Skills frontmatter and package naming;
- matching versions across `SKILL.md`, `VERSION`, and `manifest.json`;
- parseable interface, manifest, and evaluation files;
- common private-token patterns;
- no raw provider response payloads, environment files, or local caches in the release package;
- a clean extraction and load of the Skill-only archive.

The repository intentionally contains public documentation and product walkthrough media. These assets are not part of the Skill-only archive.

## Re-run

```text
python scripts/validate_package.py
agentskills validate /absolute/path/to/agent-expert-panel
```

Do not publish when either command fails. Review the exact changed-file and archive scope before tagging a release.

## Reporting

Do not include private prompts, credentials, sensitive data, or access tokens in a public issue. Report a security concern through GitHub's private vulnerability reporting channel when available.