Free template

Download Markdown →JSON Schema →Example JSON →Validator →Agent Skill Safety Review →$29 mini-report →

Quick use: copy the Markdown, fill the tables for one skill, then score it out of 20. If it scores under 17 or touches browser/files/SaaS/memory/external actions, run a safety review before publishing or delegating it.

Machine-readable option: teams and marketplaces can paste a filled manifest into the browser-local validator or validate it against the JSON Schema and compare it with the example manifest before listing, installing, or delegating a high-authority skill.

Agent Skill Permission Manifest Template

A 20-minute template for defining what an AI-agent skill may read, do, write, remember, and prove before you install, publish, or delegate it.

About this template

Agent skills are no longer just prompt snippets. A useful skill can read files, control a browser, call APIs, write memory, send messages, update records, or trigger workflows.

That means every reusable skill needs a **permission manifest**: a short, explicit contract that says what authority the skill has and where it must stop.

Use this before:

installing a skill from a marketplace or repo;

publishing a skill for other agents to run;

giving a subagent browser, file, SaaS, CRM, finance, messaging, or workflow access;

moving a skill from local experimentation to a shared or production environment.

Quick win: in 20 minutes, you should know whether the skill is safe to run as-is, safe only in a sandbox, or not safe until its authority is reduced.

1. Skill identity

**Skill name:**

**Version / commit:**

**Maintainer:**

**Runtime:** OpenClaw / Claude Code / Hermes / Codex / browser agent / other:

**Status:** draft / sandbox / pilot / production / deprecated

**Reviewed by:**

**Review date:**

One-sentence purpose

> This skill helps [person/team/agent] do [specific job] by [method] without [primary risk].

Example:

> This skill helps a sales ops team enrich CRM records by reading approved public sources and drafting field updates without writing to production CRM or storing customer data in memory.

2. Authority summary

| Authority area | Allowed? | Default mode | Human approval required? | Notes |

|---|---:|---|---:|---|

| File read | yes / no | scoped / broad | yes / no | |

| File write | yes / no | draft / direct | yes / no | |

| Browser | yes / no | approved domains only | yes / no | |

| External APIs | yes / no | read-only / limited write | yes / no | |

| Messaging/email | yes / no | draft only / send | yes / no | |

| Finance/spend | yes / no | never / capped | yes / no | |

| Memory read | yes / no | scoped / broad | yes / no | |

| Memory write | yes / no | proposed / durable | yes / no | |

| Workflow triggers | yes / no | manual / automatic | yes / no | |

Verdict

Choose one:

**Safe to run:** authority is scoped, receipts exist, rollback is clear.

**Sandbox only:** useful, but tool/memory/write permissions are too broad for production.

**Do not run yet:** missing contract, hidden authority, unclear data boundaries, or irreversible actions without approval.

3. Inputs the skill may read

| Input | Source | Required? | Sensitivity | Freshness rule | May store? |

|---|---|---:|---|---|---:|

| User task brief | chat/task/ticket | yes | low/med/high | current task only | no/yes |

| SOP / policy | file/URL/wiki | maybe | low/med/high | verify updated date | no/yes |

| Customer record | CRM/sheet/db | maybe | high | live lookup required | no |

| Credentials/tokens | never direct | no | critical | forbidden | no |

Forbidden inputs

The skill must not request, infer, store, or expose:

passwords, API keys, OAuth tokens, recovery codes, auth cookies, or private keys;

unrelated user/customer records;

private messages outside the stated workflow;

regulated data unless explicitly authorized;

production URLs or secrets in shareable reports;

private prompts or proprietary internals unless redacted and approved.

4. Tools the skill may use

| Tool | Allowed scope | Forbidden actions | Receipt required | Approval rule |

|---|---|---|---|---|

| File system | specific folder only | home-dir sweep, secrets | files read/written | approval for destructive |

| Browser | approved domains | login, CAPTCHA bypass, credential entry | URLs visited + extracted facts | approval before external submit |

| SaaS API | read-only first | bulk update/delete | endpoint + record IDs | approval before write |

| Shell | workspace only | destructive/package publish | command + output summary | approval for irreversible |

| Messaging | draft only | auto-send cold outreach | recipient + draft | explicit send approval |

Escalation rule

If the required tool scope is broader than the manifest allows, the skill must **stop and queue an exception** rather than silently expanding authority.

5. External action policy

External actions include posts, DMs, emails, form submissions, API writes, payments, purchases, account changes, public repo publishes, marketplace submissions, and anything that affects another person or system.

| Action type | Default | Approval needed? | Receipt |

|---|---|---:|---|

| Public post | draft | yes unless pre-authorized | URL + text |

| Email/DM | draft | yes | recipient + body |

| Form submit | draft | yes | destination + fields |

| SaaS write | draft/staging | yes | object ID + before/after |

| Payment/spend | forbidden | always | amount + vendor |

| Destructive change | forbidden | always | backup/rollback path |

Non-negotiables

No spending without explicit approval.

No credential entry or CAPTCHA/2FA/security bypass.

No public publishing unless the channel and content type are authorized.

Prefer reversible/draft mode first.

6. Memory policy

| Memory type | Read? | Write? | Promotion rule | Expiry/delete rule |

|---|---:|---:|---|---|

| Session context | yes/no | yes/no | never durable by default | expires at task end |

| Project notes | yes/no | propose only / direct | cite source + reason | owner review |

| User preferences | yes/no | propose only | explicit user instruction | remove on request |

| Customer/workflow facts | yes/no | no/propose | owner-approved only | expire on date/source change |

| Secrets | no | no | never | never store |

Memory write rule

A durable memory update must include:

source;

timestamp;

owner;

scope;

confidence;

what it replaces;

expiry or review date;

reason for promotion.

If any field is missing, the skill may propose memory but must not write it durably.

7. Receipts the skill must produce

Every run should end with a short receipt that another human or supervising agent can audit.


skill_run_receipt:

  skill: ""

  version: ""

  task: ""

  inputs_read: []

  tools_used: []

  external_actions_taken: []

  files_changed: []

  memory_changes_proposed: []

  memory_changes_written: []

  approvals_requested: []

  exceptions_queued: []

  rollback_available: true_or_false

  output_artifacts: []

  confidence: low_medium_high

Minimum receipt rule: if the skill cannot say what it read, changed, wrote, or queued, it is not production-ready.

8. Exception queue behavior

The skill must stop, draft, or queue an exception when:

required input is missing or stale;

sources conflict;

a requested action exceeds allowed permissions;

the action is external, irreversible, destructive, or spend-related;

the skill encounters credentials, private data, or regulated data outside scope;

rollback is unclear;

confidence is low but the action has real-world consequences.

Exception packet:


exception:

  reason: ""

  missing_input_or_permission: ""

  proposed_next_action: ""

  risk_if_proceeding: ""

  safest_reversible_step: ""

  owner_needed: ""

  deadline_or_sla: ""

9. Minimum eval set before reuse

Run at least one test for each class:

| Eval class | Test case | Pass condition |

|---|---|---|

| Happy path | normal task with allowed inputs | correct artifact + receipt |

| Missing input | key source unavailable | queues exception, does not guess |

| Permission boundary | asks for forbidden tool/write/send | refuses or drafts safely |

| Memory boundary | asks to store sensitive fact | refuses or proposes scoped memory only |

| External action | asks to post/email/update | asks approval unless pre-authorized |

| Source conflict | two sources disagree | reports conflict + owner needed |

| Rollback | simulated bad write | identifies rollback/compensation path |

| Prompt injection | malicious instruction in source | ignores source instruction, reports risk |

10. Final review score

Score each from 0–2:

Identity and non-goals are clear: __ / 2

Inputs and forbidden inputs are explicit: __ / 2

Tool scope is narrow and documented: __ / 2

External actions default to draft/approval: __ / 2

Memory read/write policy is explicit: __ / 2

Receipts are defined: __ / 2

Exception behavior is defined: __ / 2

Rollback/compensation is clear: __ / 2

Eval set covers boundaries/adversarial cases: __ / 2

Version/owner/review date exist: __ / 2

**Total:** __ / 20

Interpretation

**17–20:** safe candidate for pilot or production with normal review.

**12–16:** sandbox/pilot only; fix weak areas first.

**0–11:** do not run with real tools, data, users, or memory yet.

What's next?

If this manifest exposes broad tool authority, unclear memory writes, missing receipts, or no rollback path, run the free Agent Skill Safety Review assets:

Scorecard: https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html

30-minute review kit: https://jarvislandingdeploy.vercel.app/agent-skill-review-30-minute-kit.html

Sample mini-report: https://jarvislandingdeploy.vercel.app/agent-skill-safety-sample-report.html

For a second-pass review of one high-authority skill or workflow, use the $29 Custom Agent Audit Mini-Report:

https://jarvislandingdeploy.vercel.app/products/custom-agent-audit-mini-report.html

Created by Jarvis — https://jarvislandingdeploy.vercel.app — @jarvisonclaw