Agent Infrastructure Notes #1

Skill safety reviews are the new package reviews.

Agent skills are becoming reusable software components. Once a skill can use tools, read memory, edit files, browse, message people, or trigger workflows, the risk is no longer just the prompt — it is the authority around it.

Published July 7, 2026 · For agent builders, platform teams, AI consultants, and marketplace operators.

Run the free scorecard → Read the review framework → Markdown version →

The short version

A reusable agent skill is no longer “just a prompt” once it can call tools, read files, browse, write memory, message people, or trigger workflows.

The review surface is not just the instruction text. It is what the skill can read, change, remember, trigger, and leave behind as evidence.

what it can read
what it can change
which tools it can call
what memory it can write
when it must stop
what receipt proves what happened
how it fails when the request is ambiguous

A mediocre prompt with broad permissions can do more damage than an obviously risky prompt with tight boundaries.

The review that actually matters

Most skill reviews ask: “Does this instruction look reasonable?” That is not enough for production use.

Scope
What is the skill explicitly allowed to do?

Non-scope
What requests must it refuse or route elsewhere?

Inputs
Which inputs are required, optional, forbidden, or unsafe?

Tools
Which tools can it call, at what scope, and with what approval gates?

Memory
Can it write durable memory, preferences, todos, decisions, or operating facts?

Receipts
What evidence does it leave after each meaningful action?

Exceptions
What happens when facts conflict, context is stale, or the action is irreversible?

Rollback
What state must be preserved before it changes anything?

Memory is part of the blast radius

Portable skills get especially risky around memory. A skill may run in one environment where memory is private and temporary, then get reused in another where memory is shared, durable, or consumed by other agents.

If a skill can propose durable facts, preferences, decisions, or todo updates, it needs a memory-write policy:

Which memory writes are allowed?
Which must stay as draft/proposed state?
Who or what approves promotion to durable truth?
What source, timestamp, owner, and expiry are recorded?
How are conflicts handled?
How are wrong memories rolled back?

Without this, one bad run can quietly become future operating truth.

Safe failure is the product

A production-ready skill should not try to succeed at all costs. It should fail in ways that are inspectable and recoverable:

deny ambiguous requests
draft before external actions
require human review for irreversible writes
refuse unsupported workflows
preserve an audit trail
avoid silent memory mutation
surface exceptions instead of improvising
record enough context for replay, rollback, or review

Practical 10-minute skill review

Surface	Question
Instructions	What is this skill trying to do?
Inputs	What must be provided before it runs?
Non-goals	What must it never do?
Tools	What can it actually change?
Data	What private or sensitive context can it read?
Memory	What can it preserve or poison?
Receipts	What evidence does it leave behind?
Exceptions	When does it stop or ask?
Rollback	How do we undo or compensate?
Evals	What tests prove the boundary works?

If you cannot answer these, the skill is not ready for production authority yet.

Free artifacts

Paid next step: If you want outside judgment on one real skill or workflow, use the Custom Agent Audit Mini-Report explainer or go to the product page.