Before you publish or run an agent skill, check the contract.
Reusable AI-agent skills are becoming software packages. The failure mode is not bad instructions — it is unclear authority: hidden inputs, vague tool scope, missing receipts, unsafe memory writes, and no eval contract.
Use this when a skill is about to cross a trust boundary.
Publishing a skill
You want other agents or humans to run it without guessing its permissions, failure modes, or output contract.
Buying or installing a skill
You need a quick read on whether the skill can touch files, browsers, SaaS tools, credentials, memory, or external users safely.
Delegating to subagents
The skill will run inside a larger multi-agent workflow and needs receipts, handoff rules, and exception behavior.
Moving across runtimes
The skill must survive OpenClaw, Claude Code, Hermes, Codex-style agents, or browser-only agents without relying on hidden local assumptions.
What the $29 review checks
- Skill identity: job-to-be-done, non-goals, intended runner, and version.
- Input contract: required inputs, forbidden inputs, private-data handling, and source freshness.
- Tool authority: allowed tools, forbidden actions, credential boundaries, and spend/destructive-action rules.
- Output contract: expected artifact, schema, confidence notes, and evidence requirements.
- Receipt requirements: what the skill must log so a human or supervising agent can audit the run.
- Memory policy: what may be read, proposed, written, promoted, expired, or never stored.
- Exception behavior: when to stop, draft, ask, escalate, or refuse.
- Eval contract: minimum happy-path, edge-case, adversarial, and rollback tests before reuse.
What the deliverable looks like
Sample Agent Skill Safety Mini-Report
A fictional browser-to-CRM enrichment skill review showing the exact style of output: readiness score, top risks, field-level permissions, receipt schema, memory policy, eval cases, rollback gaps, and launch verdict.
Not sure if you need a review?
Run the free Agent Skill Safety Scorecard
Score one skill in five minutes across identity, inputs, tool authority, outputs, receipts, memory policy, exceptions, evals, rollback, and portability. It runs locally in your browser and stores nothing.
The custom review workflow
1. Run the free scorecard
Use the browser-local scorecard to find obvious gaps in identity, permissions, memory policy, evals, rollback, and portability.
2. Fill the redacted intake
Paste the skill contract, intended workflow, allowed tools, sample inputs/outputs, and known failure modes — without secrets.
3. Buy the mini-report
The $29 checkout is for one skill or workflow where a second-pass launch verdict is worth more than another generic checklist.
4. Use the fix list
You get a concise readiness score, top risks, missing contract fields, receipts/evals to add, and a publish/pilot/do-not-run verdict.
Deliverable
Custom Agent Audit Mini-Report
A short review of one skill or workflow: readiness score, top risks, missing contract fields, suggested receipts/evals, and a launch verdict.
Free path if you are not ready to buy
Start with the 30-Minute Agent Skill Review Kit, the Portable Agent Skill Contract Template, the Agent Skill Permission Manifest Template, the Agent Marketplace Safety Checklist, the Agent Skill Listing Readiness Template, and the Agent Skill Buyer Due Diligence Checklist. If your skill cannot pass those assets, it is not ready to publish, sell, or delegate yet.
For skills that operate real browsers, desktops, files, SaaS apps, CRMs, finance tools, or internal systems, also use the Machine Orchestration Pilot Handoff Kit.
If you need to share this funnel outside X, use the Agent Skill Safety Review Share Pack for LinkedIn, Medium/newsletter, community reply, warm email, and X fallback copy.
OpenClaw-specific checklist
If you are reviewing an OpenClaw skill specifically, start with the OpenClaw Skill Safety Checklist before granting browser, file, memory, SaaS, message, or public-posting authority.