Marketplace / registry implementation brief

Agent skill marketplaces need a safety listing standard.

Reusable agent skills are software packages with authority. If a marketplace lets skills touch files, memory, browsers, SaaS tools, messages, workflows, or customers, the listing needs to disclose the contract before installation.

Open the full safety review funnel → Download Markdown → Marketplace checklist → Get a $29 mini-report →

The risk

Many skill listings describe only the happy path. A useful listing exposes the trust boundary: allowed actions, expected data, tool scope, memory behavior, receipts, exception handling, and eval evidence.

Without that contract, buyers cannot distinguish a safe reusable workflow from a prompt-shaped supply-chain risk.

Minimum listing standard

Identity

Job-to-be-done, non-goals, intended runner, version, owner.

Input contract

Required inputs, forbidden inputs, private-data boundaries, freshness assumptions.

Tool authority

Allowed tools, forbidden tools, destructive/spend/external-action policy.

Output contract

Expected artifact/schema, evidence requirements, confidence notes.

Receipts + memory

What gets logged, what may be read/written/proposed/expired, and what must never be stored.

Exceptions + evals

When to stop or escalate, plus happy-path, edge-case, adversarial, and rollback tests.

Three-lane review workflow

Lane	When to use	Required checks	Outcome
Self-attested	Low-risk text-only skills	Listing fields + 30-minute review kit	Publish with low-risk label
Verified	Files, memory, browser, SaaS, or messaging authority	Scorecard + sample receipts + eval evidence	Feature only after fixes
Restricted	Spend, deletion, credentials, regulated data, customer-facing authority, irreversible actions	Human review + red-team cases + rollback plan	Pilot privately or reject

Buyer-facing labels

Text-only: no tools, no memory writes, no external actions.
Reads local context: can inspect files, memory, or documents but should not modify them.
Writes local state: can edit files, create artifacts, or propose memory updates.
Controls tools: can use browser, SaaS, shell, APIs, or workflow systems.
External action: can message, post, submit forms, trigger workflows, or affect third parties.
Restricted authority: spend, deletion, credentials, regulated data, or irreversible operations.

A skill can carry multiple labels. The highest-risk label should drive review depth.

Copy/paste marketplace policy

To protect buyers and operators, every agent skill submitted to this marketplace must disclose its input contract, tool authority, output contract, receipt behavior, memory policy, exception behavior, and minimum eval evidence. Skills requesting file, browser, SaaS, messaging, memory-write, spend, destructive, regulated-data, customer-facing, or irreversible authority may require additional review before publication or featuring.

Fast implementation plan

Day 1: Add the listing fields above to the submission form.
Day 2: Add labels for tool/memory/external-action authority.
Day 3: Require sample receipts and at least four eval cases for tool-using skills.
Day 4: Create a restricted-authority review lane for spend, deletion, credentials, customer-facing workflows, and regulated data.
Day 5: Publish the policy and apply it to all newly featured skills.

Resources

Escalate one skill to a $29 mini-report →

Do not send secrets. Use redacted skill descriptions, tool lists, sample inputs/outputs, receipts, and eval results.