Agent Skill Permission Manifest Examples

Why this exists

A permission manifest is only useful if builders know what “good” looks like. These examples turn the safety-review thesis into concrete manifests teams can copy, narrow, validate, and attach to a skill before giving it browser, file, SaaS, memory, messaging, or code authority.

Pick the nearest example

How to use these examples

1. Copy the closest manifest.
2. Remove any tool or action the skill does not strictly need.
3. Replace vague verbs like “manage,” “update,” or “optimize” with reviewable operations.
4. Add receipts that would explain what happened after a failure.
5. Validate the final manifest locally before install or publication.

Example 1 — Browser research skill

{
  "skill_id": "public-browser-research-brief",
  "version": "1.0.0",
  "purpose": "Research public web sources and produce a cited brief.",
  "allowed_actions": [
    "read public web pages",
    "summarize findings",
    "capture source URLs and timestamps",
    "draft recommendations"
  ],
  "forbidden_actions": [
    "log in to accounts",
    "submit forms",
    "send messages",
    "purchase anything",
    "scrape private or gated data",
    "write durable memory without approval"
  ],
  "inputs": {
    "required": ["research question", "target audience", "source freshness requirement"],
    "forbidden": ["passwords", "session cookies", "private customer data"]
  },
  "tools": {
    "browser": "public_read_only",
    "web_fetch": "public_read_only"
  },
  "memory_policy": {
    "read": "project_context_only",
    "write": "propose_only",
    "promotion_requires": "human_approval"
  },
  "receipts": [
    "query used",
    "source URLs",
    "retrieval timestamps",
    "claims with citations",
    "uncertain or conflicting facts",
    "actions not taken because they required login or write authority"
  ],
  "escalation": [
    "source conflict",
    "paywalled/gated source needed",
    "user asks for login or private data access",
    "source older than freshness window"
  ],
  "install_verdict": "safe_with_read_only_browser_scope"
}

Review note: this is safe only if “research” never silently expands into account login, outreach, scraping, or CRM updates.

Example 2 — CRM enrichment skill

{
  "skill_id": "crm-enrichment-draft-notes",
  "version": "1.0.0",
  "purpose": "Research public company facts and draft CRM enrichment notes for human review.",
  "allowed_actions": [
    "read assigned CRM account record",
    "read public company sources",
    "draft enrichment note",
    "flag stale or conflicting fields"
  ],
  "forbidden_actions": [
    "edit lifecycle stage",
    "change account owner",
    "edit billing or contract fields",
    "send email",
    "create tasks for other people",
    "overwrite existing notes",
    "import personal data from unofficial sources"
  ],
  "inputs": {
    "required": ["CRM account id", "company domain", "fields requested"],
    "forbidden": ["API keys in prompt", "private customer notes unless explicitly scoped"]
  },
  "tools": {
    "crm": "read_account_and_create_draft_note_only",
    "browser": "public_read_only"
  },
  "memory_policy": {
    "read": "workflow_specific",
    "write": "none_by_default",
    "proposed_updates": "allowed_only_for_source_rules_or_repeatable_exceptions"
  },
  "receipts": [
    "CRM record id",
    "fields read",
    "fields proposed",
    "sources for each proposed fact",
    "confidence per field",
    "fields skipped",
    "human approval required before write"
  ],
  "escalation": [
    "conflicting company identity",
    "low-confidence source",
    "requested write outside draft note scope",
    "private/person-level data requested",
    "CRM automation would be triggered"
  ],
  "install_verdict": "pilot_only_with_draft_note_scope"
}

Review note: “draft only” is the difference between a useful assistant and a silent CRM corruption engine.

Example 3 — Memory-writing skill

{
  "skill_id": "project-memory-consolidator",
  "version": "1.0.0",
  "purpose": "Turn raw session notes into proposed durable project memory updates.",
  "allowed_actions": [
    "read approved memory files",
    "read current session summary",
    "propose memory additions",
    "propose outdated-memory removals",
    "record source and reason for each proposed change"
  ],
  "forbidden_actions": [
    "silently overwrite durable memory",
    "store secrets or credentials",
    "promote unverified claims",
    "share private memory outside the allowed context",
    "delete historical logs"
  ],
  "inputs": {
    "required": ["memory scope", "source notes", "promotion criteria"],
    "forbidden": ["secrets", "third-party private data", "unredacted credentials"]
  },
  "tools": {
    "file_read": "memory_scope_only",
    "file_write": "proposed_patch_or_draft_only"
  },
  "memory_policy": {
    "states": ["observed", "proposed", "approved", "durable", "expired", "revoked"],
    "durable_write_requires": "explicit approval_or_preapproved_low_risk_scope",
    "each_update_requires": ["source", "timestamp", "reason", "replaces", "expiry_or_review_date"]
  },
  "receipts": [
    "memory files read",
    "proposed additions",
    "proposed removals",
    "conflicts found",
    "approval status",
    "final diff if applied"
  ],
  "escalation": [
    "secret detected",
    "conflicting memory",
    "unclear owner",
    "cross-context privacy risk",
    "destructive edit requested"
  ],
  "install_verdict": "requires_memory_write_gate"
}

Review note: the dangerous memory bug is not forgetting. It is remembering too easily.

Example 4 — Code review skill

{
  "skill_id": "agent-code-reviewer",
  "version": "1.0.0",
  "purpose": "Review code changes and produce prioritized findings with evidence.",
  "allowed_actions": [
    "read repository files",
    "read diff",
    "run safe local tests if already configured",
    "draft review comments",
    "suggest patches"
  ],
  "forbidden_actions": [
    "push commits without explicit task authority",
    "merge pull requests",
    "change CI/CD secrets",
    "install new dependencies without approval",
    "post public comments without approval",
    "delete files or branches"
  ],
  "inputs": {
    "required": ["repo path or PR diff", "review scope", "risk focus"],
    "forbidden": ["production secrets", "personal tokens in prompt"]
  },
  "tools": {
    "filesystem": "read_repo_and_write_patch_draft",
    "test_runner": "safe_existing_commands_only",
    "git_host": "read_only_unless_explicitly_authorized"
  },
  "memory_policy": {
    "read": "repo_guidance_only",
    "write": "propose_lessons_only_after_review"
  },
  "receipts": [
    "files inspected",
    "commands run",
    "test results",
    "findings with line references",
    "patches suggested",
    "actions requiring human approval"
  ],
  "escalation": [
    "destructive command needed",
    "secret detected",
    "production deployment risk",
    "ambiguous review scope",
    "external comment or merge requested"
  ],
  "install_verdict": "safe_for_draft_reviews_not_automerge"
}

Review note: code review can be low-risk; automated merge/deploy is a different product and needs a stricter manifest.

Example 5 — Messaging or outbound skill

{
  "skill_id": "outbound-message-drafter",
  "version": "1.0.0",
  "purpose": "Draft personalized outreach messages for warm or approved prospects.",
  "allowed_actions": [
    "research approved prospect context",
    "draft message variants",
    "score personalization quality",
    "prepare send-ready copy for human review"
  ],
  "forbidden_actions": [
    "send DMs or emails without explicit approval",
    "message cold prospects at scale",
    "invent personalization",
    "use private data without consent",
    "evade rate limits",
    "create accounts",
    "buy lists or placements"
  ],
  "inputs": {
    "required": ["prospect list", "offer", "relationship context", "allowed channel"],
    "forbidden": ["scraped private emails", "sensitive personal data", "passwords or session cookies"]
  },
  "tools": {
    "browser": "public_read_only",
    "messaging": "draft_only",
    "email": "draft_only"
  },
  "memory_policy": {
    "read": "lead_context_only",
    "write": "log_drafts_and_outcomes_only",
    "do_not_store": ["private inbox content", "unapproved personal data"]
  },
  "receipts": [
    "source used for personalization",
    "message draft",
    "why recipient is appropriate",
    "approval status",
    "send status if later approved",
    "opt-out or do-not-contact flags"
  ],
  "escalation": [
    "recipient is not clearly relevant",
    "message would be cold spam",
    "private data needed",
    "send action requested without approval",
    "rate limit or platform warning appears"
  ],
  "install_verdict": "draft_only_until_explicit_send_authority"
}

Review note: the line between helpful sales support and spam is authority plus relevance. Draft-first is the safe default.

Quick verdict rubric

• Safe to install: read-only or draft-only, clear forbidden actions, receipts defined, no durable memory writes without policy.
• Pilot with limits: needs one tool write lane, but scope is narrow, reversible, and receipt-backed.
• Needs review: can send, publish, buy, delete, deploy, change customer/account records, or write durable memory.
• Reject for now: vague scope, broad tool access, no receipts, no escalation behavior, asks for secrets, or tries to bypass platform/account controls.

Next step

Use the free artifacts first. Fill the template, validate locally, run the scorecard, and only request the $29 mini-report for high-authority skills where an outside verdict is worth it.