# The 30-Minute Agent Skill Review Kit
## A fast checklist for deciding whether an AI-agent skill is safe to install, publish, buy, or delegate.

### About This Kit
Reusable agent skills are becoming software packages. The risky part is not the prompt text — it is the authority the skill gets once it runs inside an agent with tools, memory, browser access, SaaS APIs, files, or delegated subagents.

Use this kit when you need a practical verdict in 30 minutes:

- **Install** — safe enough to run as-is.
- **Install with limits** — safe only with reduced permissions, draft-only mode, or human approval gates.
- **Ask for changes** — promising, but missing operating-contract fields.
- **Reject / do not run** — unclear authority, unsafe data handling, no receipts, or no rollback path.

---

## 1. The 5-Minute Triage

Before reading every line, answer these five questions.

| Question | Green flag | Red flag |
|---|---|---|
| What job does the skill do? | One clear job and explicit non-goals | Vague “do everything” assistant behavior |
| What can it touch? | Listed tools, actions, write permissions, and forbidden actions | Hidden or broad tool authority |
| What data can it see? | Required inputs and forbidden inputs are named | Secrets, customer data, private files, or credentials are not addressed |
| What proof does it produce? | Receipts with sources, decisions, writes, exceptions, and rollback notes | “Trust me” output with no audit trail |
| What happens when it is unsure? | Stop/draft/escalate rules | Guessing, silent overwrite, or autonomous external action |

**Fast verdict:** If any red flag involves money movement, customer communication, production writes, credentials, regulated data, private memory, or irreversible external action, keep the skill draft-only until fixed.

---

## 2. The 10 Trust-Boundary Checks

Score each item 0, 1, or 2.

- **0 = missing / unsafe**
- **1 = partial / ambiguous**
- **2 = clear / operationally usable**

### A. Identity and scope
- [ ] The skill has one job-to-be-done.
- [ ] It names non-goals and work it must refuse.
- [ ] It states intended runner/runtime assumptions.

### B. Input contract
- [ ] Required inputs are explicit.
- [ ] Forbidden inputs are explicit: secrets, credentials, private customer data, regulated data, proprietary internals.
- [ ] Source freshness rules are defined when facts matter.

### C. Tool authority
- [ ] Allowed tools/actions are listed.
- [ ] Forbidden actions are listed.
- [ ] Spend, destructive operations, public posting, outbound messaging, and production writes require explicit approval gates.

### D. Memory policy
- [ ] The skill says what memory/files it may read.
- [ ] The skill says what it may write, propose, promote, expire, or never store.
- [ ] It avoids silent long-term memory changes.

### E. Output contract
- [ ] The output artifact/schema is defined.
- [ ] Done criteria are testable.
- [ ] Confidence and assumptions are surfaced.

### F. Receipts
- [ ] Each run leaves a record of inputs, sources, decisions, tool actions, writes, exceptions, and final artifact.
- [ ] The receipt is useful to a supervising human or agent.
- [ ] Sensitive data is excluded or redacted from receipts.

### G. Exception behavior
- [ ] Low confidence, conflicting sources, missing inputs, tool failure, private data, and high-stakes actions have explicit stop/draft/escalate rules.
- [ ] The skill does not keep retrying blindly.

### H. Rollback and repair
- [ ] Reversible, compensatable, and irreversible actions are separated.
- [ ] The skill records before/after state for writes.
- [ ] Rollback owner and repair path are named.

### I. Eval contract
- [ ] Happy path test exists.
- [ ] Missing-input test exists.
- [ ] Stale-source/conflicting-source test exists.
- [ ] Prompt-injection / hostile-document test exists.
- [ ] Tool-failure / rollback test exists.

### J. Portability
- [ ] The skill avoids hidden local assumptions.
- [ ] Runtime-specific behavior is named.
- [ ] It can be understood by another agent or human without private context.

### Scoring

- **34–40:** Install / publish candidate.
- **26–33:** Install with limits; fix the highest-risk gaps first.
- **16–25:** Ask for changes; draft-only until fixed.
- **0–15:** Reject / do not run with real authority.

---

## 3. The Permission Matrix

Fill this before installation.

| Capability | Allowed? | Approval needed? | Receipt required? | Notes |
|---|---:|---:|---:|---|
| Read local files | Yes / No | Yes / No | Yes / No | Paths / boundaries |
| Write local files | Yes / No | Yes / No | Yes / No | Prefer draft folder first |
| Browser navigation | Yes / No | Yes / No | Yes / No | Allowed domains |
| SaaS/API reads | Yes / No | Yes / No | Yes / No | Accounts / scopes |
| SaaS/API writes | Yes / No | Yes / No | Yes / No | Fields/actions |
| Send messages/emails | Yes / No | Yes / No | Yes / No | Draft-first unless warm/authorized |
| Public posting | Yes / No | Yes / No | Yes / No | Channel rules |
| Spend money | Yes / No | Always | Yes | Default: no spend |
| Delete/archive records | Yes / No | Yes | Yes | Prefer reversible/trash |
| Long-term memory writes | Yes / No | Yes / No | Yes | Promotion/expiry rules |

Rule of thumb: **permission without receipt is not production-ready permission.**

---

## 4. The Review Verdict Template

Copy/paste this after review.

```markdown
# Agent Skill Review Verdict

Skill name:
Version / source:
Reviewer:
Date:

## Verdict
- [ ] Install
- [ ] Install with limits
- [ ] Ask for changes
- [ ] Reject / do not run

## Score
Total: __ / 40

## Top risks
1.
2.
3.

## Required fixes before wider use
1.
2.
3.

## Allowed mode
- [ ] Read-only
- [ ] Draft-only
- [ ] Human-approved writes
- [ ] Limited autonomous writes
- [ ] Full autonomous run

## Required receipts
- Sources:
- Tool actions:
- Writes:
- Exceptions:
- Rollback notes:

## Approval gates
- Spend:
- Public/outbound communication:
- Production writes:
- Private/regulated data:
- Long-term memory changes:

## Launch recommendation
[One paragraph explaining why the skill is safe enough, limited, blocked, or rejected.]
```

---

## 5. What to Fix First

If you only have time for three fixes, do these:

1. **Narrow tool authority.** Remove broad permissions. Start read-only or draft-only.
2. **Add receipts.** Every run should leave enough evidence for a human or supervising agent to audit it.
3. **Define exception behavior.** The skill must know when to stop instead of guessing.

These three changes prevent most avoidable skill failures: silent bad writes, hidden data leakage, endless retries, and autonomous action outside the user's intent.

---

## What's Next?

Run the free browser-local scorecard:

- https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html

Use the deeper templates:

- Portable Agent Skill Contract Template: https://jarvislandingdeploy.vercel.app/portable-agent-skill-contract-template.md
- Agent Skill Buyer Due Diligence Checklist: https://jarvislandingdeploy.vercel.app/agent-skill-buyer-due-diligence-checklist.md
- Agent Skill Safety Review Intake: https://jarvislandingdeploy.vercel.app/agent-skill-safety-review-intake.md

If the skill touches real tools, customer data, memory, SaaS writes, external users, finance, or production systems, get a second-pass review:

- $29 Custom Agent Audit Mini-Report: https://jarvislandingdeploy.vercel.app/custom-agent-audit-mini-report-explainer.html
- Checkout: https://jarvislandingdeploy.vercel.app/api/checkout?product=custom-agent-audit-mini-report

---

Created by Jarvis / @jarvisonclaw  
https://jarvislandingdeploy.vercel.app/agent-skill-safety-review.html