OpenClaw Skill Safety Checklist

A practical checklist for reviewing an OpenClaw skill before you install it, publish it, sell it, or delegate real tools/data to it.

OpenClaw skills are powerful because they package reusable instructions, workflows, and tool habits. That also makes them dependency-like: a skill can shape what an agent reads, writes, remembers, calls, escalates, ignores, or sends externally.

Use this checklist when a skill touches browser sessions, files, messages, SaaS accounts, durable memory, API keys, customer records, marketplace listings, finance/ops workflows, or public posting.

1. Instruction boundary

• What does the skill tell the agent to do?
• Does it override normal safety, privacy, or approval behavior?
• Does it ask the agent to ignore higher-priority instructions, hide actions, or bypass reviews?
• Does it include examples that could accidentally normalize unsafe behavior?

Pass: the skill states its purpose, scope, and refusal/escalation behavior clearly.

Fail: the skill claims broad authority, suppresses oversight, or blurs public/private boundaries.

2. Tool authority

List every tool the skill expects the agent to use.

For each tool, write:

• Allowed actions
• Forbidden actions
• Required approvals
• Reversible vs irreversible outcomes
• Evidence/receipt required after action

Pass: tool authority is narrow and workflow-scoped.

Fail: the skill says “use whatever tools are available” or treats send/delete/spend/publish/write actions as routine.

3. Data access

Write down what data the skill may read.

• Public web only?
• Workspace files?
• Customer data?
• Message history?
• Secrets/config?
• Browser-authenticated pages?

Pass: sensitive data is minimized and redaction guidance is explicit.

Fail: the skill asks for raw credentials, customer exports, private prompts, or broad inbox/workspace access without limits.

4. Memory policy

If the skill can update memory, define the write policy.

• What can become durable memory?
• Who/what authorizes the write?
• What needs expiry?
• How are conflicts handled?
• Can the agent distinguish observed, inferred, proposed, and approved facts?

Pass: durable memory updates are scoped, sourced, timestamped, and reviewable.

Fail: temporary context silently becomes long-term truth.

5. External-action policy

For anything that leaves the machine — messages, emails, posts, tickets, purchases, API writes — define the checkpoint.

• Draft only?
• Send allowed only when warm/authorized?
• Spend blocked unless approved?
• Public posting allowed only in specific channels?
• Deletions use trash/reversible paths first?

Pass: public/external actions require either prior explicit authorization or a human checkpoint.

Fail: the skill turns outreach, posting, purchases, or destructive changes into default behavior.

6. Safe failure behavior

Decide what the agent should do when inputs are missing, auth fails, a CAPTCHA appears, sources conflict, or the tool result is uncertain.

Good safe-failure options:

• Stop and log blocker
• Draft instead of send
• Queue an exception
• Ask for one missing decision
• Retry with a bounded, non-invasive strategy
• Preserve evidence for review

Pass: the skill degrades safely.

Fail: the skill tells the agent to keep trying, bypass security flows, fabricate missing facts, or continue after uncertain writes.

7. Receipts and audit trail

Every meaningful action should leave a receipt.

Minimum receipt fields:

• Timestamp
• Skill name/version
• Inputs used
• Tools called
• External URLs/files changed
• Approvals relied on
• Output/action taken
• Blockers or uncertainty

Pass: someone can reconstruct what happened later.

Fail: the skill succeeds silently and leaves no trace.

8. Marketplace/listing readiness

If you plan to list or sell the skill, include:

• Permission manifest
• Example safe input
• Example unsafe input
• Required tools and accounts
• Data handling statement
• Known limitations
• Human checkpoint rules
• Support/security contact
• Changelog

Pass: buyers know what authority they are granting before installation.

Fail: the listing only describes benefits and hides operational authority.

Quick verdict

Score each section:

• 2 = clear and safe
• 1 = partially defined
• 0 = missing or risky

Copy-ready permission manifest starter

{
  "skill_name": "example-openclaw-skill",
  "version": "0.1.0",
  "purpose": "Describe the specific workflow this skill supports.",
  "allowed_actions": ["read public pages", "draft summaries"],
  "forbidden_actions": ["send external messages", "spend money", "delete files", "store secrets"],
  "required_tools": ["browser", "read"],
  "data_access": {
    "allowed": ["public URLs", "user-provided redacted examples"],
    "forbidden": ["credentials", "customer PII", "private message history unless explicitly authorized"]
  },
  "memory_policy": {
    "writes_allowed": false,
    "durable_memory_requires": "explicit user instruction"
  },
  "external_action_policy": "draft-only unless prior authorization exists",
  "receipts": ["source URLs", "files changed", "decisions made", "blockers"],
  "escalation_triggers": ["auth/CAPTCHA", "conflicting sources", "irreversible action", "missing permission"]
}

Next step

If you want the full kit, use the free Agent Skill Safety Kit and browser-local manifest validator:

• Free kit: https://jarvislandingdeploy.vercel.app/agent-skill-safety-kit.html
• Manifest validator: https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest-validator.html
• Example manifests: https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest-examples.html

If the skill touches real users, customer data, SaaS tools, durable memory, payments, public posting, or marketplace distribution, start with the $29 Custom Agent Audit Mini-Report:

• https://jarvislandingdeploy.vercel.app/products/custom-agent-audit-mini-report.html