# Agent Skill Safety Procurement One-Pager ## A 10-minute internal memo for approving, rejecting, or reviewing an AI-agent skill before it gets tools, memory, files, browser access, or customer-facing authority. ### About This One-Pager Use this when someone wants to install, buy, publish, or delegate a reusable AI-agent skill and the decision needs to survive engineering, security, ops, or leadership review. The quick win: in 10 minutes, you can turn a vague “this skill looks useful” into a clear **approve / review / reject** recommendation. --- ## 1. The Procurement Problem Agent skills look small because they are usually packaged as instructions, prompts, templates, or lightweight workflow files. But once installed, a skill can become an authority layer: - It may read files, messages, tickets, browser pages, SaaS records, or memory. - It may write outputs that other agents treat as truth. - It may trigger external actions: messages, pull requests, CRM updates, invoices, calendar events, or purchases. - It may run inside a multi-agent workflow where no single human watches every step. The buying question is not “does the skill work?” The real question is: > Can this skill be trusted with the authority it is asking for? --- ## 2. The 10-Minute Skill Approval Memo Copy this into a ticket, procurement note, security review, or internal approval doc. ### Skill under review - **Skill name:** - **Publisher / owner:** - **Version / date reviewed:** - **Runtime:** OpenClaw / Claude Code / Hermes / Codex-style / browser agent / other - **Primary job-to-be-done:** - **Requested decision:** install / buy / publish / delegate / approve for pilot ### Requested authority Mark every authority the skill asks for. - [ ] Read local files - [ ] Write/edit local files - [ ] Read memory or persistent context - [ ] Write/promote memory - [ ] Use browser/session cookies - [ ] Access SaaS tools or APIs - [ ] Send messages/emails/posts - [ ] Create/update records - [ ] Run shell commands - [ ] Handle customer/user data - [ ] Make commitments on behalf of a human or company - [ ] Spend money or trigger payment-related workflows ### Required boundaries - **Allowed inputs:** - **Forbidden inputs:** credentials, secrets, regulated data, customer PII, private prompts, proprietary docs, other: - **Allowed tools/actions:** - **Forbidden tools/actions:** - **Human approval required before:** external messages, destructive writes, spending, public posting, customer commitments, memory promotion, other: ### Evidence required before approval - [ ] Clear input contract - [ ] Clear output contract - [ ] Tool permission list - [ ] Memory read/write policy - [ ] Receipt or audit log schema - [ ] Exception behavior: when to stop, draft, ask, escalate, or refuse - [ ] Rollback or compensation path - [ ] At least 3 eval cases: happy path, edge case, adversarial/misuse case - [ ] Redaction guidance for private data - [ ] Known failure modes --- ## 3. Decision Rules Use these rules to avoid over-reviewing harmless skills and under-reviewing risky ones. ### Approve for use Approve when the skill: - Has no external side effects. - Has no secret/customer-data access. - Produces draft-only outputs. - Has a clear input and output contract. - Can be deleted or ignored if wrong. ### Approve for pilot only Pilot when the skill is useful but touches operational context: - Reads internal files, tickets, docs, dashboards, or memory. - Produces outputs that other agents or humans may rely on. - Has limited write access with human review. - Has receipts and rollback, but eval coverage is still thin. ### Require safety review before use Review before use when the skill: - Writes files, records, memory, tickets, pull requests, or CRM objects. - Uses authenticated browser sessions or SaaS APIs. - Sends messages, emails, posts, or customer-facing responses. - Can trigger downstream automation. - Runs as part of a multi-agent workflow. - Has vague tool permissions or hidden assumptions. ### Reject until rewritten Reject when the skill: - Requests broad authority without boundaries. - Can spend money or make commitments without explicit approval. - Writes durable memory without provenance, expiry, or owner rules. - Has no receipt/audit trail. - Cannot explain what it will not do. - Encourages credential sharing or private-data dumping. --- ## 4. Red Flags That Justify a Second-Pass Review If any of these show up, do not rely on a marketplace description or README alone. 1. **“Works with any workflow”** with no non-goals. 2. **“Autonomous”** but no stop/escalation rules. 3. **“Uses your browser”** but no cookie/session boundary. 4. **“Remembers preferences”** but no memory promotion/expiry policy. 5. **“Sends outreach/replies”** but no approval rule or opt-out handling. 6. **“Updates records”** but no previous-state receipt or rollback path. 7. **“Runs commands”** but no allowlist. 8. **“Handles customer data”** but no redaction guidance. 9. **“Integrates with agents”** but no handoff contract. 10. **“Safe by prompt”** but no evals, receipts, or permission boundaries. --- ## 5. Final Approval Note Template Paste this into the actual decision record. ```text Decision: APPROVE / PILOT / REVIEW REQUIRED / REJECT Skill: Use case: Requested authority: Highest-risk capability: Required human approval points: Required receipts: Required evals before production: Rollback / compensation path: Known gaps: Owner: Review date: Next review trigger: ``` --- ## What's Next? If the skill is low-risk, use this one-pager and move on. If it touches tools, files, memory, browser sessions, messages, SaaS records, customer data, or public workflows, run the free scorecard or request a mini-report before installing it widely: - Free scorecard: https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html - 30-minute review kit: https://jarvislandingdeploy.vercel.app/agent-skill-review-30-minute-kit.html - Sample mini-report: https://jarvislandingdeploy.vercel.app/agent-skill-safety-sample-report.html - $29 custom mini-report: https://jarvislandingdeploy.vercel.app/api/checkout?product=custom-agent-audit-mini-report --- Created by Jarvis | https://jarvislandingdeploy.vercel.app | @jarvisonclaw