# Agent Skill Safety Review

## Before you publish or run an agent skill, check the contract.

Reusable AI-agent skills are becoming software packages. The failure mode is not bad instructions — it is unclear authority: hidden inputs, vague tool scope, missing receipts, unsafe memory writes, and no eval contract.

**Primary CTA:** [$29 Custom Agent Audit Mini-Report](https://jarvislandingdeploy.vercel.app/products/custom-agent-audit-mini-report.html)  
**Checkout:** https://jarvislandingdeploy.vercel.app/api/checkout?product=custom-agent-audit-mini-report  
**Free template:** https://jarvislandingdeploy.vercel.app/portable-agent-skill-contract-template.md  
**Sample mini-report:** https://jarvislandingdeploy.vercel.app/agent-skill-safety-sample-report.md  
**Redaction-friendly intake:** https://jarvislandingdeploy.vercel.app/agent-skill-safety-review-intake.md  
**Marketplace checklist:** https://jarvislandingdeploy.vercel.app/agent-marketplace-safety-checklist.md  
**Share pack:** https://jarvislandingdeploy.vercel.app/agent-skill-safety-review-share-pack.md
**Portable kit:** https://jarvislandingdeploy.vercel.app/agent-skill-safety-kit.html
**ZIP download:** https://jarvislandingdeploy.vercel.app/downloads/agent-skill-safety-kit.zip

## Use this when a skill crosses a trust boundary

- Publishing a skill for other agents or humans to run.
- Buying or installing a skill that touches files, browsers, SaaS tools, credentials, memory, or external users.
- Delegating a skill to subagents inside a larger multi-agent workflow.
- Moving a skill across OpenClaw, Claude Code, Hermes, Codex-style agents, or browser-only agents.

## What the $29 review checks

1. Skill identity: job-to-be-done, non-goals, intended runner, and version.
2. Input contract: required inputs, forbidden inputs, private-data handling, and source freshness.
3. Tool authority: allowed tools, forbidden actions, credential boundaries, spend/destructive-action rules.
4. Output contract: expected artifact, schema, confidence notes, and evidence requirements.
5. Receipt requirements: what the skill must log so a human or supervising agent can audit the run.
6. Memory policy: what may be read, proposed, written, promoted, expired, or never stored.
7. Exception behavior: when to stop, draft, ask, escalate, or refuse.
8. Eval contract: happy-path, edge-case, adversarial, and rollback tests before reuse.

## What the deliverable looks like

Read the [Sample Agent Skill Safety Mini-Report](https://jarvislandingdeploy.vercel.app/agent-skill-safety-sample-report.md) to see the expected format: readiness score, top risks, field-level permissions, receipt schema, memory policy, eval cases, rollback gaps, and launch verdict for a fictional browser-to-CRM enrichment skill.

## Custom review workflow

1. Run the free scorecard to find obvious gaps in identity, permissions, memory policy, evals, rollback, and portability.
2. Fill the [Agent Skill Safety Review Intake](https://jarvislandingdeploy.vercel.app/agent-skill-safety-review-intake.md) without leaking secrets. It captures identity, trust boundaries, tools, memory policy, receipts, exception behavior, and eval cases — exactly the information needed for a useful mini-report.
3. Buy the [$29 Custom Agent Audit Mini-Report](https://jarvislandingdeploy.vercel.app/api/checkout?product=custom-agent-audit-mini-report) when one outside launch verdict is worth more than another generic checklist.
4. Use the report's fix list: readiness score, top risks, missing contract fields, suggested receipts/evals, and publish/pilot/do-not-run verdict.

If you need to send a redacted intake or ask whether the workflow fits, use the [contact page](https://jarvislandingdeploy.vercel.app/contact.html).

**Do not send secrets.** The review works from a redacted skill description, tool list, intended workflow, and sample inputs/outputs. Keep credentials, private customer data, proprietary internals, regulated data, and private prompts out of the intake unless explicitly authorized by your organization.

## Deliverable

A short custom mini-report for one skill or workflow:

- readiness score
- top risks
- missing contract fields
- suggested receipts/evals
- launch verdict

## Free path

Start with the [Portable Agent Skill Contract Template](https://jarvislandingdeploy.vercel.app/portable-agent-skill-contract-template.md) and the [Agent Marketplace Safety Checklist](https://jarvislandingdeploy.vercel.app/agent-marketplace-safety-checklist.md). If your skill cannot pass those two assets, it is not ready to publish, sell, or delegate yet.

For skills that operate real browsers, desktops, files, SaaS apps, CRMs, finance tools, or internal systems, also use the Machine Orchestration Pilot Handoff Kit.


## Share / repurpose pack

If X is unavailable, use the [Agent Skill Safety Review Share Pack](https://jarvislandingdeploy.vercel.app/agent-skill-safety-review-share-pack.md) for LinkedIn, Medium/newsletter, community reply, warm email, and X fallback copy.