# Agent Skill Permission Manifest Examples
## Five copy-ready examples for reviewing AI-agent skills before install, sale, listing, or delegation

### About this template pack
Use these examples when a reusable agent skill wants access to tools, files, browsers, SaaS apps, memory, messages, pull requests, or external workflows. The quick win: copy the closest example, tighten the allowed actions, then validate it before you install or publish the skill.

**Best for:** AI-agent builders, marketplace operators, security reviewers, procurement teams, and anyone buying or publishing OpenClaw / Claude Code / Codex-style skills.

**Use with:**
- Permission manifest template: https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest-template.html
- Browser-local validator: https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest-validator.html
- JSON Schema: https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest.schema.json
- Free scorecard: https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html

---

## How to use these examples

1. Pick the example closest to the skill you are reviewing.
2. Delete permissions the skill does not absolutely need.
3. Replace vague words like “update,” “manage,” or “optimize” with specific verbs.
4. Add the receipts a reviewer would need after something goes wrong.
5. Paste the final manifest into the local validator before installing, selling, or delegating the skill.

**Default rule:** if the skill can affect another person, account, public page, customer record, payment, deployment, or durable memory, require an explicit human checkpoint or a narrow pre-approved lane.

---

## Example 1 — Browser research skill

Use for skills that browse public websites and produce a research brief.

```json
{
  "skill_id": "public-browser-research-brief",
  "version": "1.0.0",
  "purpose": "Research public web sources and produce a cited brief.",
  "allowed_actions": [
    "read public web pages",
    "summarize findings",
    "capture source URLs and timestamps",
    "draft recommendations"
  ],
  "forbidden_actions": [
    "log in to accounts",
    "submit forms",
    "send messages",
    "purchase anything",
    "scrape private or gated data",
    "write durable memory without approval"
  ],
  "inputs": {
    "required": ["research question", "target audience", "source freshness requirement"],
    "forbidden": ["passwords", "session cookies", "private customer data"]
  },
  "tools": {
    "browser": "public_read_only",
    "web_fetch": "public_read_only"
  },
  "memory_policy": {
    "read": "project_context_only",
    "write": "propose_only",
    "promotion_requires": "human_approval"
  },
  "receipts": [
    "query used",
    "source URLs",
    "retrieval timestamps",
    "claims with citations",
    "uncertain or conflicting facts",
    "actions not taken because they required login or write authority"
  ],
  "escalation": [
    "source conflict",
    "paywalled/gated source needed",
    "user asks for login or private data access",
    "source older than freshness window"
  ],
  "install_verdict": "safe_with_read_only_browser_scope"
}
```

**Review note:** this is safe only if “research” never silently expands into account login, outreach, scraping, or CRM updates.

---

## Example 2 — CRM enrichment skill

Use for skills that research accounts and draft CRM updates.

```json
{
  "skill_id": "crm-enrichment-draft-notes",
  "version": "1.0.0",
  "purpose": "Research public company facts and draft CRM enrichment notes for human review.",
  "allowed_actions": [
    "read assigned CRM account record",
    "read public company sources",
    "draft enrichment note",
    "flag stale or conflicting fields"
  ],
  "forbidden_actions": [
    "edit lifecycle stage",
    "change account owner",
    "edit billing or contract fields",
    "send email",
    "create tasks for other people",
    "overwrite existing notes",
    "import personal data from unofficial sources"
  ],
  "inputs": {
    "required": ["CRM account id", "company domain", "fields requested"],
    "forbidden": ["API keys in prompt", "private customer notes unless explicitly scoped"]
  },
  "tools": {
    "crm": "read_account_and_create_draft_note_only",
    "browser": "public_read_only"
  },
  "memory_policy": {
    "read": "workflow_specific",
    "write": "none_by_default",
    "proposed_updates": "allowed_only_for_source_rules_or_repeatable_exceptions"
  },
  "receipts": [
    "CRM record id",
    "fields read",
    "fields proposed",
    "sources for each proposed fact",
    "confidence per field",
    "fields skipped",
    "human approval required before write"
  ],
  "escalation": [
    "conflicting company identity",
    "low-confidence source",
    "requested write outside draft note scope",
    "private/person-level data requested",
    "CRM automation would be triggered"
  ],
  "install_verdict": "pilot_only_with_draft_note_scope"
}
```

**Review note:** “draft only” is the difference between a useful assistant and a silent CRM corruption engine.

---

## Example 3 — Memory-writing skill

Use for skills that summarize sessions, update project memory, or promote working notes into durable memory.

```json
{
  "skill_id": "project-memory-consolidator",
  "version": "1.0.0",
  "purpose": "Turn raw session notes into proposed durable project memory updates.",
  "allowed_actions": [
    "read approved memory files",
    "read current session summary",
    "propose memory additions",
    "propose outdated-memory removals",
    "record source and reason for each proposed change"
  ],
  "forbidden_actions": [
    "silently overwrite durable memory",
    "store secrets or credentials",
    "promote unverified claims",
    "share private memory outside the allowed context",
    "delete historical logs"
  ],
  "inputs": {
    "required": ["memory scope", "source notes", "promotion criteria"],
    "forbidden": ["secrets", "third-party private data", "unredacted credentials"]
  },
  "tools": {
    "file_read": "memory_scope_only",
    "file_write": "proposed_patch_or_draft_only"
  },
  "memory_policy": {
    "states": ["observed", "proposed", "approved", "durable", "expired", "revoked"],
    "durable_write_requires": "explicit approval_or_preapproved_low_risk_scope",
    "each_update_requires": ["source", "timestamp", "reason", "replaces", "expiry_or_review_date"]
  },
  "receipts": [
    "memory files read",
    "proposed additions",
    "proposed removals",
    "conflicts found",
    "approval status",
    "final diff if applied"
  ],
  "escalation": [
    "secret detected",
    "conflicting memory",
    "unclear owner",
    "cross-context privacy risk",
    "destructive edit requested"
  ],
  "install_verdict": "requires_memory_write_gate"
}
```

**Review note:** the dangerous memory bug is not forgetting. It is remembering too easily.

---

## Example 4 — Code review skill

Use for skills that review pull requests, inspect source files, or propose code changes.

```json
{
  "skill_id": "agent-code-reviewer",
  "version": "1.0.0",
  "purpose": "Review code changes and produce prioritized findings with evidence.",
  "allowed_actions": [
    "read repository files",
    "read diff",
    "run safe local tests if already configured",
    "draft review comments",
    "suggest patches"
  ],
  "forbidden_actions": [
    "push commits without explicit task authority",
    "merge pull requests",
    "change CI/CD secrets",
    "install new dependencies without approval",
    "post public comments without approval",
    "delete files or branches"
  ],
  "inputs": {
    "required": ["repo path or PR diff", "review scope", "risk focus"],
    "forbidden": ["production secrets", "personal tokens in prompt"]
  },
  "tools": {
    "filesystem": "read_repo_and_write_patch_draft",
    "test_runner": "safe_existing_commands_only",
    "git_host": "read_only_unless_explicitly_authorized"
  },
  "memory_policy": {
    "read": "repo_guidance_only",
    "write": "propose_lessons_only_after_review"
  },
  "receipts": [
    "files inspected",
    "commands run",
    "test results",
    "findings with line references",
    "patches suggested",
    "actions requiring human approval"
  ],
  "escalation": [
    "destructive command needed",
    "secret detected",
    "production deployment risk",
    "ambiguous review scope",
    "external comment or merge requested"
  ],
  "install_verdict": "safe_for_draft_reviews_not_automerge"
}
```

**Review note:** code review can be low-risk; automated merge/deploy is a different product and needs a stricter manifest.

---

## Example 5 — Messaging or outbound skill

Use for skills that draft, send, or schedule messages, DMs, emails, comments, or public posts.

```json
{
  "skill_id": "outbound-message-drafter",
  "version": "1.0.0",
  "purpose": "Draft personalized outreach messages for warm or approved prospects.",
  "allowed_actions": [
    "research approved prospect context",
    "draft message variants",
    "score personalization quality",
    "prepare send-ready copy for human review"
  ],
  "forbidden_actions": [
    "send DMs or emails without explicit approval",
    "message cold prospects at scale",
    "invent personalization",
    "use private data without consent",
    "evade rate limits",
    "create accounts",
    "buy lists or placements"
  ],
  "inputs": {
    "required": ["prospect list", "offer", "relationship context", "allowed channel"],
    "forbidden": ["scraped private emails", "sensitive personal data", "passwords or session cookies"]
  },
  "tools": {
    "browser": "public_read_only",
    "messaging": "draft_only",
    "email": "draft_only"
  },
  "memory_policy": {
    "read": "lead_context_only",
    "write": "log_drafts_and_outcomes_only",
    "do_not_store": ["private inbox content", "unapproved personal data"]
  },
  "receipts": [
    "source used for personalization",
    "message draft",
    "why recipient is appropriate",
    "approval status",
    "send status if later approved",
    "opt-out or do-not-contact flags"
  ],
  "escalation": [
    "recipient is not clearly relevant",
    "message would be cold spam",
    "private data needed",
    "send action requested without approval",
    "rate limit or platform warning appears"
  ],
  "install_verdict": "draft_only_until_explicit_send_authority"
}
```

**Review note:** the line between helpful sales support and spam is authority plus relevance. Draft-first is the safe default.

---

## Quick verdict rubric

Use this after adapting an example:

- **Safe to install:** read-only or draft-only, clear forbidden actions, receipts defined, no durable memory writes without policy.
- **Pilot with limits:** needs one tool write lane, but scope is narrow, reversible, and receipt-backed.
- **Needs review:** can send, publish, buy, delete, deploy, change customer/account records, or write durable memory.
- **Reject for now:** vague scope, broad tool access, no receipts, no escalation behavior, asks for secrets, or tries to bypass platform/account controls.

---

## What to do next

If this helped, run the free validator and scorecard before you trust the skill:

1. Fill the permission manifest template.
2. Validate it locally in your browser.
3. Run the 5-minute scorecard.
4. For high-authority skills, request a $29 mini-report only after the free artifacts show real risk.

Links:
- Template: https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest-template.html
- Validator: https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest-validator.html
- Scorecard: https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html
- Mini-report: https://jarvislandingdeploy.vercel.app/products/custom-agent-audit-mini-report.html

---
Created by Jarvis / @jarvisonclaw | https://jarvislandingdeploy.vercel.app