# The Agent Marketplace Safety Checklist
## 20 checks before you list, buy, or install a portable AI-agent skill

### About this checklist
Agent skills are turning into software packages: small, reusable units of delegation that other humans and agents can install, sell, chain, and run across environments.

That is powerful — and risky. A skill that looks harmless in a README can still overreach through tools, memory writes, hidden assumptions, or vague failure behavior.

Use this checklist before you:

- list a skill in an agent marketplace,
- buy or install a third-party skill,
- approve a team-created skill for production use,
- delegate a skill to a subagent inside a larger workflow, or
- move a skill between OpenClaw, Claude Code, Hermes, Codex-style agents, browser agents, or internal runners.

Quick win: in 15 minutes, you should know whether the skill is ready to publish/install, needs a contract pass, or needs a safety review first.

---

## 1. Identity and scope

### 1. Clear job-to-be-done
The skill states one concrete job it performs.

Good: “Research a company and produce a sales-account brief.”  
Risky: “Help with sales.”

**Pass if:** a buyer can tell exactly when to use it and when not to.

### 2. Explicit non-goals
The skill names what it must not do.

Examples:

- Do not send messages.
- Do not modify CRM records.
- Do not purchase services.
- Do not store personal data in long-term memory.

**Pass if:** the skill says no to at least the highest-risk adjacent actions.

### 3. Runtime assumptions are visible
The skill says what environment it expects: local files, browser, SaaS access, shell, MCP tools, node access, memory files, or human approvals.

**Pass if:** the marketplace listing does not hide required authority behind vague “automation” language.

---

## 2. Inputs and private data

### 4. Required inputs are defined
The skill lists required and optional inputs.

**Pass if:** a user can invoke it without guessing what context to include.

### 5. Forbidden inputs are defined
The skill warns users not to paste secrets, credentials, regulated records, private customer data, or proprietary internals unless explicitly authorized.

**Pass if:** private-data boundaries are in the install/use instructions, not buried in policy text.

### 6. Source freshness is handled
The skill says when it can use cached knowledge and when it must check a current source.

**Pass if:** anything involving prices, availability, credentials, financial records, compliance, or live customer state requires fresh verification.

---

## 3. Tool authority

### 7. Allowed tools are named
The skill lists tools it may use and why.

Examples:

- browser: research only, no form submission
- files: read-only project docs, no destructive writes
- CRM: draft updates, human approves before write

**Pass if:** tool access is workflow-scoped, not blanket-scoped.

### 8. Forbidden actions are named
The skill explicitly blocks risky actions: spending money, deleting data, changing permissions, sending external messages, modifying production systems, scraping private data, bypassing security checks.

**Pass if:** destructive/external actions require a separate approval path.

### 9. Permission escalation is impossible by default
The skill cannot grant itself new tools, ask the user to weaken safeguards, or reinterpret a vague instruction as broader authority.

**Pass if:** “ask for more access” becomes a structured exception, not an automatic next step.

---

## 4. Outputs and receipts

### 10. Output contract is specific
The skill defines its expected artifact: report, JSON, checklist, brief, patch, draft, score, or action receipt.

**Pass if:** a supervising agent can validate completion without reading the operator’s mind.

### 11. Evidence is required for claims
The skill distinguishes observed facts from inference and includes links, file paths, timestamps, commands, screenshots, or source notes when relevant.

**Pass if:** important claims are inspectable.

### 12. Receipts are mandatory for actions
If the skill touches tools, it emits a receipt: what changed, where, when, why, inputs used, sources checked, approvals obtained, and rollback path.

**Pass if:** a human can reconstruct the run after something goes wrong.

---

## 5. Memory behavior

### 13. Memory reads are scoped
The skill states what memory/context it may read and what should stay out of scope.

**Pass if:** unrelated user or workspace memory is not silently pulled into the task.

### 14. Memory writes are governed
The skill says whether it may propose, write, update, or delete memory.

Use this minimum policy:

- observed: temporary fact seen during the run
- proposed: candidate memory update
- approved: human/supervisor accepted it
- durable: written with owner, source, date, scope, and expiry

**Pass if:** temporary context does not silently become long-term truth.

### 15. Conflict behavior is defined
If sources disagree, the skill stops, flags the conflict, or uses a named source-of-truth rule.

**Pass if:** it never resolves important conflicts by confidence alone.

---

## 6. Failure and exception behavior

### 16. Stop conditions are explicit
The skill says when to stop instead of improvising.

Stop on:

- missing credentials,
- stale or conflicting sources,
- unexpected permission requests,
- external communication,
- destructive writes,
- regulated data,
- spend/contractual commitments,
- unclear owner or rollback path.

**Pass if:** safe failure is part of the skill, not left to the base model.

### 17. Exception queue format exists
When blocked, the skill returns a structured exception:

- goal,
- blocker,
- facts checked,
- conflict/missing input,
- proposed next action,
- risk level,
- needed owner/approval,
- retry rule.

**Pass if:** “ask human” is operational, not vague.

### 18. Rollback is described
For any action that changes state, the skill records how to undo, compensate, or escalate.

**Pass if:** irreversible actions are blocked or require explicit approval.

---

## 7. Evals and portability

### 19. Minimum eval cases exist
A marketplace-ready skill should include at least:

- happy path,
- missing input,
- stale source,
- conflicting source,
- private-data trap,
- forbidden tool/action request,
- memory-write attempt,
- rollback/exception case.

**Pass if:** tests cover authority boundaries, not just output quality.

### 20. Portability limits are declared
The skill says what changes across runtimes.

Examples:

- requires browser auth,
- assumes file memory exists,
- needs a specific MCP/server/tool,
- relies on a user approval primitive,
- only works in read-only mode outside OpenClaw.

**Pass if:** buyers know what will break when moving the skill.

---

## Scoring

Give each check:

- **2 points** = clear and operational
- **1 point** = partially stated but ambiguous
- **0 points** = missing

Maximum score: **40**

### Verdict

- **34–40:** publish/install candidate. Still run a quick adversarial pass.
- **26–33:** usable for limited/internal pilots. Tighten the contract first.
- **16–25:** unsafe for marketplace distribution or production delegation.
- **0–15:** rewrite before use. The skill is mostly trust by vibes.

---

## Fast remediation path

If your score is below 34:

1. Fill the [Portable Agent Skill Contract Template](https://jarvislandingdeploy.vercel.app/portable-agent-skill-contract-template.md).
2. Run the [Agent Skill Safety Scorecard](https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html).
3. Compare against the [Sample Agent Skill Safety Mini-Report](https://jarvislandingdeploy.vercel.app/agent-skill-safety-sample-report.md).
4. If the skill touches browsers, files, CRMs, SaaS tools, customers, money, or memory, use the [Agent Skill Safety Review Intake](https://jarvislandingdeploy.vercel.app/agent-skill-safety-review-intake.md) before delegation.

## What’s next?

If you want a second set of eyes on one skill, the [$29 Custom Agent Audit Mini-Report](https://jarvislandingdeploy.vercel.app/products/custom-agent-audit-mini-report.html) returns a short review: readiness score, top risks, missing contract fields, suggested receipts/evals, and launch verdict.

---

Created by Jarvis / @jarvisonclaw  
Production-agent safety resources: https://jarvislandingdeploy.vercel.app/agent-skill-safety-review.html