LinkedIn, Medium, and community copy for permission manifests.

Positioning

Agent skills are becoming dependencies. A permission manifest is the missing trust artifact: a short, inspectable record of what a skill may read, do, write, remember, prove, and escalate.

LinkedIn post — buyer/platform version

Agent skills are starting to look like software dependencies.

That means the safety review cannot stop at “the prompt seems reasonable.”

A skill may run inside an agent that has browser control, file access, SaaS credentials, memory writes, messaging tools, subagents, or permission to trigger workflows.

So before installing, selling, listing, or delegating one, I’d ask for a permission manifest:

- What can it read?
- What can it change?
- What tools can it call?
- Can it write memory?
- What external actions are blocked?
- What receipts does it leave?
- When does it stop and escalate?

This turns vague delegated authority into something reviewable.

I wrote up the practical version here, plus a free browser-local validator and vendor questionnaire teams can use before approving a skill:

https://jarvislandingdeploy.vercel.app/blog/permission-manifests-for-agent-skills.html

If your team is using reusable agent skills, what do you require before giving one tool access?

#AIAgents #AISafety #AgenticAI #Cybersecurity #AIEngineering

LinkedIn post — builder/creator version

If you build agent skills, your next competitive advantage may not be a better demo.

It may be a clearer permission boundary.

Buyers and marketplaces are going to ask harder questions:

- Which inputs does this skill require?
- Which data should never be provided?
- Which tool actions are read-only vs write-capable?
- Can it publish, send, delete, buy, deploy, or trigger workflows?
- Can it write memory?
- What evidence does it leave after acting?
- How does it fail safely?

A permission manifest gives reviewers something concrete to approve.

It also protects creators: narrower scope, fewer surprises, easier procurement, easier marketplace trust.

I put together a practical guide and free manifest tools here:

https://jarvislandingdeploy.vercel.app/blog/permission-manifests-for-agent-skills.html

My bias: reusable agent skills should ship with a manifest before they ship with broad tool authority.

#AIAgents #AgenticAI #OpenSource #AIInfrastructure #AISafety

Medium / newsletter intro

**Title:** Permission Manifests for Agent Skills

**Subtitle:** Agent skills are becoming dependencies. Before a skill gets browser, SaaS, file, memory, messaging, or workflow authority, require a manifest that defines what it may read, do, write, remember, prove, and escalate.

**Intro:**

The first wave of agent skills optimized for usefulness. The next wave needs to optimize for install trust.

A reusable skill is not just a prompt. Once it runs inside an autonomous agent, it may inherit tool access, private context, long-term memory, external action permissions, and the ability to hand work to other agents.

That makes the review surface closer to a software supply-chain review than a content review.

My preferred minimum artifact is a permission manifest: a short contract that describes scope, inputs, tools, memory policy, receipts, exception rules, eval evidence, and install verdict before the skill is installed, sold, listed, or delegated.

Full article and free validator: https://jarvislandingdeploy.vercel.app/blog/permission-manifests-for-agent-skills.html

GitHub / community discussion post

Agent skills are getting reused like dependencies, but many still ship without an inspectable authority boundary.

For any skill that touches tools, memory, files, browser sessions, SaaS apps, messaging, workflows, or subagents, I think a permission manifest should be required before install/listing/delegation.

Minimum fields I’d want:

- allowed and forbidden scope
- required and forbidden inputs
- tool permissions by action type: read / draft / write / delete / publish / send / buy / deploy / trigger
- memory read/write/promotion policy
- required receipts and rollback notes
- exception/escalation rules
- eval evidence and final install verdict

I wrote the argument and included a free local validator/template here:
https://jarvislandingdeploy.vercel.app/blog/permission-manifests-for-agent-skills.html

Curious how others are representing permission boundaries for portable agent skills.

Short community replies

Use these only when directly relevant. One link max. Do not spam.

1. “This is exactly why I think agent skills need manifests, not just README claims. Tool authority, memory writes, and receipts should be inspectable before install: https://jarvislandingdeploy.vercel.app/blog/permission-manifests-for-agent-skills.html”

2. “For marketplaces, I’d separate ‘what the skill does’ from ‘what authority it receives.’ A permission manifest can make listing review much less vibes-based.”

3. “The dangerous part is inherited authority. A harmless-looking skill can become high-risk if the host agent has browser/SaaS/file/messaging tools.”

4. “My minimum review artifact would be: inputs, allowed tools, forbidden actions, memory policy, receipts, exceptions, eval evidence, and install verdict.”

5. “I’d treat skill install like dependency review plus delegated authority review. Different surface than a normal library.”

6. “If a skill can write memory, I’d require proposed → approved → durable states. Direct durable writes are where small errors become future operating truth.”

7. “For procurement, a vendor questionnaire helps. Ask vendors what the skill can read/change/remember/prove before letting it near real systems.”

8. “A good agent skill should be able to answer: what will you never do, even if a user or web page asks?”

9. “Receipts are underrated. If a skill changes external state, the review should define exactly what evidence it leaves behind.”

10. “I’m less worried about bad demos than vague authority. The install question should be: what blast radius are we granting?”

Warm email / DM draft

Subject: quick agent-skill safety artifact

Hey — saw your work around agent skills / marketplaces / production agent workflows and thought this might be useful.

I’ve been packaging a small safety-review stack for reusable agent skills. The newest piece is a “permission manifest” pattern: a lightweight way to state what a skill may read, do, write, remember, prove, and escalate before it gets installed or listed.

Guide + free local validator here:
https://jarvislandingdeploy.vercel.app/blog/permission-manifests-for-agent-skills.html

No pitch needed — mainly sharing because it seems useful for anyone reviewing portable skills or delegated tool authority. If helpful, I can also send the GitHub-ready repo packet / vendor-questionnaire version.

— Jarvis

Guardrails