# Agent Skill Safety Review — Marketplace Operator Brief

A one-page brief for teams running an AI-agent skill marketplace, internal skill registry, or community directory.

Use this when people can publish reusable skills that ask agents to read memory, touch files, control browsers, call SaaS tools, message users, spend money, or modify workflows.

## The risk

Agent skills are becoming software packages, but many listings still describe only the happy path.

A useful marketplace listing needs to expose the trust boundary before installation:

- What the skill is allowed to do
- What data it expects
- Which tools it can call
- Whether it writes memory
- What it logs as a receipt
- How it behaves on uncertainty, failure, secrets, destructive actions, and external communication
- Which evals prove it is safe enough to run

Without that contract, buyers cannot distinguish a safe reusable workflow from a prompt-shaped supply-chain risk.

## Minimum listing standard

Require every skill listing to include these fields before it is featured, sold, or recommended:

1. **Skill identity** — job-to-be-done, non-goals, intended runner, version, owner.
2. **Input contract** — required inputs, forbidden inputs, private-data boundaries, freshness assumptions.
3. **Tool authority** — allowed tools, forbidden tools, destructive/spend/external-action policy.
4. **Output contract** — expected artifact/schema, evidence requirements, confidence notes.
5. **Receipt schema** — what the skill logs after each meaningful action.
6. **Memory policy** — what it can read, write, propose, expire, or never store.
7. **Exception behavior** — when it stops, drafts, asks, escalates, or refuses.
8. **Eval contract** — happy path, edge cases, adversarial cases, rollback/repair tests.
9. **Portability notes** — runtime assumptions across OpenClaw, Claude Code, Codex-style CLIs, browser agents, or internal agents.
10. **Launch verdict** — install / install with limits / request changes / reject.

## Review workflow for marketplace operators

Use a lightweight three-lane process:

| Lane | When to use | Required checks | Outcome |
| --- | --- | --- | --- |
| Self-attested | Low-risk text-only skills | Listing fields + 30-minute review kit | Publish with low-risk label |
| Verified | Skills with files, memory, browser, SaaS, or messaging authority | Scorecard + sample receipts + eval evidence | Feature only after fixes |
| Restricted | Skills with spend, deletion, credentials, regulated data, customer-facing authority, or irreversible actions | Human review + red-team cases + rollback plan | Pilot privately or reject |

## Buyer-facing labels

Add simple labels buyers and agents can understand:

- **Text-only** — no tools, no memory writes, no external actions.
- **Reads local context** — can inspect files, memory, or documents but should not modify them.
- **Writes local state** — can edit files, create artifacts, or propose memory updates.
- **Controls tools** — can use browser, SaaS, shell, APIs, or workflow systems.
- **External action** — can message, post, submit forms, trigger workflows, or affect third parties.
- **Restricted authority** — spend, deletion, credentials, regulated data, or irreversible operations.

A skill can carry multiple labels. The highest-risk label should drive review depth.

## Copy/paste marketplace policy

> To protect buyers and operators, every agent skill submitted to this marketplace must disclose its input contract, tool authority, output contract, receipt behavior, memory policy, exception behavior, and minimum eval evidence. Skills requesting file, browser, SaaS, messaging, memory-write, spend, destructive, regulated-data, customer-facing, or irreversible authority may require additional review before publication or featuring.

## Fast implementation plan

**Day 1:** Add the listing fields above to the submission form.

**Day 2:** Add labels for tool/memory/external-action authority.

**Day 3:** Require sample receipts and at least four eval cases for tool-using skills.

**Day 4:** Create a restricted-authority review lane for spend, deletion, credentials, customer-facing workflows, and regulated data.

**Day 5:** Publish the policy and apply it to all newly featured skills.

## Free resources

- Agent Skill Safety Review: https://jarvislandingdeploy.vercel.app/agent-skill-safety-review.html
- 30-Minute Agent Skill Review Kit: https://jarvislandingdeploy.vercel.app/agent-skill-review-30-minute-kit.html
- Portable Agent Skill Contract Template: https://jarvislandingdeploy.vercel.app/portable-agent-skill-contract-template.md
- Agent Marketplace Safety Checklist: https://jarvislandingdeploy.vercel.app/agent-marketplace-safety-checklist.md
- Buyer Due Diligence Checklist: https://jarvislandingdeploy.vercel.app/agent-skill-buyer-due-diligence-checklist.md
- Sample Mini-Report: https://jarvislandingdeploy.vercel.app/agent-skill-safety-sample-report.html

## Paid escalation

If a marketplace, team, or creator wants a second-pass review for one high-risk skill, use the $29 Custom Agent Audit Mini-Report:

https://jarvislandingdeploy.vercel.app/api/checkout?product=custom-agent-audit-mini-report

Do not send secrets. Use redacted skill descriptions, tool lists, sample inputs/outputs, receipts, and eval results.