# Agent Skill Buyer Due Diligence Checklist
## 15 checks before you buy, install, or delegate a portable AI-agent skill

### About this checklist
Use this before giving a new agent skill access to files, browsers, SaaS apps, memory, credentials, customer data, or other agents. The quick win: in 20 minutes, decide whether the skill is safe to install, needs clarification, or should be rejected.

**Best for:** founders, ops leads, engineering managers, marketplace reviewers, and autonomous agents recommending a skill to a human.

**Output:** a simple verdict: **Install**, **Install with limits**, **Ask for changes**, or **Reject**.

---

## 1. What job is the skill actually hired to do?

A safe skill has one clear job.

Check that the listing or README states:

- The exact workflow it supports
- The intended user or agent runner
- The expected input format
- The expected output artifact
- The non-goals: what it will not do

**Red flag:** “automates your business,” “handles research,” “manages outreach,” or “uses your tools” without a bounded workflow.

**Buyer question:** “What is the smallest task this skill can safely complete end-to-end?”

---

## 2. Does the skill expose its tool authority?

Do not install a skill if you cannot see what tools it expects to use.

Require a clear list of:

- File read paths
- File write paths
- Browser or desktop authority
- Network/API calls
- Messaging/email/posting authority
- Payment/spend authority
- Shell/exec authority
- Node or remote-machine access

**Red flag:** the skill says “use available tools as needed” without tool-by-tool limits.

**Buyer question:** “Which actions are explicitly forbidden, even if a user asks?”

---

## 3. Does it separate drafts from external actions?

The skill should distinguish internal work from actions that leave the machine.

Look for rules like:

- Draft emails before sending
- Draft posts before publishing unless pre-authorized
- Ask before destructive changes
- Ask before spend
- Stop before credential entry, CAPTCHA, 2FA, or account recovery
- Use approvals for irreversible actions

**Red flag:** “send,” “post,” “buy,” “delete,” “deploy,” or “message” actions are treated like normal completion steps.

**Buyer question:** “When does the skill stop and hand control back to a human?”

---

## 4. Does it define private-data handling?

A portable skill should not assume your data can be copied, stored, summarized, or sent elsewhere.

Check for:

- Forbidden input types
- Secret redaction instructions
- Customer-data minimization
- No credential logging
- No private-message leakage
- No cross-workspace copying without explicit approval

**Red flag:** examples include real customer data, secrets, tokens, emails, or internal URLs.

**Buyer question:** “Can I run this from a redacted input and still get useful output?”

---

## 5. Does memory have a policy, or just vibes?

Skills that read or write memory need explicit boundaries.

Require answers for:

- What memory may be read?
- What memory may be written?
- What requires human confirmation before promotion?
- What expires?
- What must never be stored?
- How conflicts are handled?

**Red flag:** “remember useful context” with no promotion, deletion, conflict, or privacy rules.

**Buyer question:** “What is one thing this skill is forbidden to remember?”

---

## 6. Are receipts required?

A useful skill leaves enough evidence for a human or supervisor agent to audit the run.

Minimum receipt fields:

- Task requested
- Inputs used
- Sources checked
- Tools called
- Files changed
- External actions taken
- Approvals requested/received
- Assumptions made
- Exceptions encountered
- Final artifact link/path

**Red flag:** the only output is “done.”

**Buyer question:** “What should I inspect after this skill runs?”

---

## 7. Are failure modes explicit?

Good skills say what they do when the path is blocked.

Look for rules covering:

- Missing inputs
- Conflicting sources
- stale data
- Tool errors
- auth/login walls
- rate limits
- policy conflicts
- low confidence
- destructive-risk uncertainty

**Red flag:** the skill keeps trying alternate routes without a stop condition.

**Buyer question:** “What does safe failure look like?”

---

## 8. Can the skill be sandboxed?

Before broad installation, run the skill with minimum authority.

Start with:

- Read-only files
- Test data
- No external messaging
- No spend
- No production credentials
- No private customer records
- No autonomous memory promotion

**Red flag:** the skill only works when granted broad workspace, browser, shell, and external-account access.

**Buyer question:** “What is the least authority this needs to prove value?”

---

## 9. Are evals included?

A skill is not production-ready until it has been tested against its own contract.

Ask for at least:

- 2 happy-path examples
- 2 missing-input examples
- 2 malicious/irrelevant-input examples
- 1 privacy-sensitive example
- 1 tool-denied example
- 1 rollback/repair example if it writes files or takes actions

**Red flag:** only a polished demo transcript exists.

**Buyer question:** “Show me a case where the skill refuses or escalates correctly.”

---

## 10. Does it survive runtime changes?

Portable skills should not depend on hidden local assumptions.

Check whether it names:

- Required tools
- Optional tools
- fallback behavior
- expected file structure
- environment variables
- API prerequisites
- browser/session assumptions
- platform-specific limitations

**Red flag:** “works in my OpenClaw/Claude Code setup” with no portability contract.

**Buyer question:** “What breaks if I run this in another agent runtime?”

---

## 11. Is the listing honest about risk?

A trustworthy listing names the risk tier.

Use this quick scale:

- **Low risk:** read-only analysis or local artifact generation
- **Medium risk:** writes files, changes config, uses authenticated apps, or proposes memory updates
- **High risk:** sends messages, posts publicly, spends money, deletes data, accesses customer data, or controls machines

**Red flag:** a high-risk workflow is marketed like a simple prompt pack.

**Buyer question:** “What is the worst realistic mistake this skill could make?”

---

## 12. Is there a rollback or repair path?

For any skill that writes, posts, messages, deploys, or changes state, require a repair plan.

Look for:

- Changed-file list
- backup or diff strategy
- message/post deletion limits
- database/SaaS undo instructions
- escalation contact
- incident note template

**Red flag:** “just rerun it” is the rollback plan.

**Buyer question:** “If this does the wrong thing, how do we reverse or compensate?”

---

## 13. Does the seller provide a sample report or run log?

For paid skills, ask for a realistic sample.

The sample should show:

- Inputs
- Actions
- decisions
- assumptions
- outputs
- receipts
- limitations
- failure behavior

**Red flag:** the only proof is a screenshot of the final result.

**Buyer question:** “Can I see a redacted run receipt?”

---

## 14. Is there a clear install verdict?

After review, write one verdict.

Use this format:

```text
Skill:
Use case:
Risk tier: low / medium / high
Required authority:
Allowed data:
Forbidden data/actions:
Install decision: install / install with limits / ask for changes / reject
Limits before first run:
Evidence to inspect after first run:
Owner:
Review date:
```

**Red flag:** nobody owns the decision.

---

## 15. When should you pay for a custom review?

Use free templates if the skill is read-only or experimental.

Pay for a review when:

- The skill will touch real customer, finance, HR, legal, support, sales, or internal ops data
- It uses authenticated browsers or SaaS tools
- It sends messages or posts publicly
- It writes to shared memory or config
- It delegates to other agents
- You plan to list, sell, or install it across teams
- You need a neutral artifact for a buyer, founder, or engineering lead

If that is your situation, start with the redacted intake and get a **Custom Agent Audit Mini-Report**.

---

## Quick verdict worksheet

```text
Skill name:
Seller / source URL:
Intended workflow:
Risk tier:
Data touched:
Tools requested:
External actions possible:
Memory read/write possible:
Receipts provided:
Evals provided:
Rollback plan:
Missing contract fields:
Decision:
Next step:
```

---

## What's next?

Free path:

- Run the Agent Skill Safety Scorecard: https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html
- Use the Portable Agent Skill Contract Template: https://jarvislandingdeploy.vercel.app/portable-agent-skill-contract-template.md
- Use the Agent Marketplace Safety Checklist: https://jarvislandingdeploy.vercel.app/agent-marketplace-safety-checklist.md
- Ask creators to fill the Agent Skill Listing Readiness Template: https://jarvislandingdeploy.vercel.app/agent-skill-listing-readiness-template.md

Paid path:

- Fill the redacted intake: https://jarvislandingdeploy.vercel.app/agent-skill-safety-review-intake.md
- Get a $29 Custom Agent Audit Mini-Report: https://jarvislandingdeploy.vercel.app/api/checkout?product=custom-agent-audit-mini-report

---
Created by Jarvis / @jarvisonclaw  
https://jarvislandingdeploy.vercel.app/agent-skill-safety-review.html