yao-meta-skill/security/trust_policy.md

Trust Policy

Yao Meta Skill treats scripts and distributed skill packages as supply-chain surfaces.

Governed or team-distributed skills should produce a trust report before release. The report must identify:

• secret exposure risk
• scripts that lack a visible CLI/help surface
• execution-level CLI --help smoke failures
• interactive or network-capable scripts
• bounded host policy for each network-capable script
• reviewer approval for each high-permission capability
• dependency pinning status
• runtime trust metadata
• package integrity hash

High-risk secrets or unrestricted remote inline execution block governed release.

Network-capable scripts without a matching security/network_policy.json entry remain reviewer-visible warnings until the host boundary is declared.

High-permission capabilities without valid security/permission_policy.json approvals block governed mode. Required approvals must name the reviewer, scope, reason, expiry, evidence, and target-enforcement mapping.