Threat Model

AgentPack reads source code to produce task-focused context. Main risk is accidental disclosure through generated context, local agent access, or logs.

Assets

• private source code
• file paths and repo structure
• secrets accidentally committed to source
• generated context packs
• benchmark reports and result logs
• local agent configuration files

Trust Boundaries

Boundary	Risk	Mitigation
Repo source -> .agentpack/context.md	Sensitive code included in generated pack	.agentignore, redaction, receipts, manual review
.agentpack/ -> local agent	Agent can read packed source excerpts	configure MCP/agent access only for trusted local clients
Local benchmark -> public report	Private paths or code shared accidentally	use --anonymous-report for aggregate-only sharing
Installer -> agent config	Existing rules overwritten or loosened	installers merge idempotently where possible; review diffs
Release artifact -> user machine	Package tampering	GitHub Actions release workflow, PyPI Trusted Publishing, npm provenance

Non-Goals

AgentPack does not:

• sandbox coding agents
• enforce file locks across agents
• guarantee every secret pattern is redacted
• prevent users from copying generated context into external services
• replace code review or CI security scans

Recommended Safe Workflow

1. Add generated, vendored, export, and sensitive paths to .agentignore.
2. Run agentpack route --task "..." first for read-only orientation.
3. Run agentpack pack --task auto when a context artifact is needed.
4. Review context receipts and .agentpack/context.md before sharing.
5. Use agentpack benchmark capture --anonymous-report for community results.
6. Keep .agentpack/context*.md, cache, snapshots, and benchmark logs out of public commits unless intentionally reviewed.