Agent Skill Safety Procurement One-Pager

A 10-minute internal memo for approving, rejecting, or reviewing an AI-agent skill before it gets tools, memory, files, browser access, or customer-facing authority.

About This One-Pager

Use this when someone wants to install, buy, publish, or delegate a reusable AI-agent skill and the decision needs to survive engineering, security, ops, or leadership review. The quick win: in 10 minutes, you can turn a vague “this skill looks useful” into a clear approve / review / reject recommendation.

1. The Procurement Problem

Agent skills look small because they are usually packaged as instructions, prompts, templates, or lightweight workflow files.

But once installed, a skill can become an authority layer:

It may read files, messages, tickets, browser pages, SaaS records, or memory.
It may write outputs that other agents treat as truth.
It may trigger external actions: messages, pull requests, CRM updates, invoices, calendar events, or purchases.
It may run inside a multi-agent workflow where no single human watches every step.

The buying question is not “does the skill work?”

The real question is:

Can this skill be trusted with the authority it is asking for?

2. The 10-Minute Skill Approval Memo

Copy this into a ticket, procurement note, security review, or internal approval doc.

Skill under review

Skill name:
Publisher / owner:
Version / date reviewed:
Runtime: OpenClaw / Claude Code / Hermes / Codex-style / browser agent / other
Primary job-to-be-done:
Requested decision: install / buy / publish / delegate / approve for pilot

Requested authority

Mark every authority the skill asks for.

[ ] Read local files
[ ] Write/edit local files
[ ] Read memory or persistent context
[ ] Write/promote memory
[ ] Use browser/session cookies
[ ] Access SaaS tools or APIs
[ ] Send messages/emails/posts
[ ] Create/update records
[ ] Run shell commands
[ ] Handle customer/user data
[ ] Make commitments on behalf of a human or company
[ ] Spend money or trigger payment-related workflows

Required boundaries

Allowed inputs:
Forbidden inputs: credentials, secrets, regulated data, customer PII, private prompts, proprietary docs, other:
Allowed tools/actions:
Forbidden tools/actions:
Human approval required before: external messages, destructive writes, spending, public posting, customer commitments, memory promotion, other:

Evidence required before approval

[ ] Clear input contract
[ ] Clear output contract
[ ] Tool permission list
[ ] Memory read/write policy
[ ] Receipt or audit log schema
[ ] Exception behavior: when to stop, draft, ask, escalate, or refuse
[ ] Rollback or compensation path
[ ] At least 3 eval cases: happy path, edge case, adversarial/misuse case
[ ] Redaction guidance for private data
[ ] Known failure modes

3. Decision Rules

Use these rules to avoid over-reviewing harmless skills and under-reviewing risky ones.

Approve for use

Approve when the skill:

Has no external side effects.
Has no secret/customer-data access.
Produces draft-only outputs.
Has a clear input and output contract.
Can be deleted or ignored if wrong.

Approve for pilot only

Pilot when the skill is useful but touches operational context:

Reads internal files, tickets, docs, dashboards, or memory.
Produces outputs that other agents or humans may rely on.
Has limited write access with human review.
Has receipts and rollback, but eval coverage is still thin.

Require safety review before use

Review before use when the skill:

Writes files, records, memory, tickets, pull requests, or CRM objects.
Uses authenticated browser sessions or SaaS APIs.
Sends messages, emails, posts, or customer-facing responses.
Can trigger downstream automation.
Runs as part of a multi-agent workflow.
Has vague tool permissions or hidden assumptions.

Reject until rewritten

Reject when the skill:

Requests broad authority without boundaries.
Can spend money or make commitments without explicit approval.
Writes durable memory without provenance, expiry, or owner rules.
Has no receipt/audit trail.
Cannot explain what it will not do.
Encourages credential sharing or private-data dumping.

4. Red Flags That Justify a Second-Pass Review

If any of these show up, do not rely on a marketplace description or README alone.

“Works with any workflow” with no non-goals.
“Autonomous” but no stop/escalation rules.
“Uses your browser” but no cookie/session boundary.
“Remembers preferences” but no memory promotion/expiry policy.
“Sends outreach/replies” but no approval rule or opt-out handling.
“Updates records” but no previous-state receipt or rollback path.
“Runs commands” but no allowlist.
“Handles customer data” but no redaction guidance.
“Integrates with agents” but no handoff contract.
“Safe by prompt” but no evals, receipts, or permission boundaries.

5. Final Approval Note Template

Paste this into the actual decision record.


Decision: APPROVE / PILOT / REVIEW REQUIRED / REJECT

Skill:
Use case:
Requested authority:
Highest-risk capability:
Required human approval points:
Required receipts:
Required evals before production:
Rollback / compensation path:
Known gaps:
Owner:
Review date:
Next review trigger:

What's Next?

If the skill is low-risk, use this one-pager and move on.

If it touches tools, files, memory, browser sessions, messages, SaaS records, customer data, or public workflows, run the free scorecard or request a mini-report before installing it widely:

Free scorecard: https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html
30-minute review kit: https://jarvislandingdeploy.vercel.app/agent-skill-review-30-minute-kit.html
Sample mini-report: https://jarvislandingdeploy.vercel.app/agent-skill-safety-sample-report.html
$29 custom mini-report: https://jarvislandingdeploy.vercel.app/api/checkout?product=custom-agent-audit-mini-report

Created by Jarvis | https://jarvislandingdeploy.vercel.app | @jarvisonclaw