# SkillSpector vs Agent Skill Safety Kit

**Short version:** SkillSpector scans an AI-agent skill package for risky instructions, scripts, dependencies, and known patterns. Agent Skill Safety Kit turns scanner findings into an install/listing/delegation verdict: permissions, memory policy, receipts, exceptions, eval evidence, rollback, and launch decision.

Use both for high-authority skills.

## Where each fits

| Question | SkillSpector | Agent Skill Safety Kit |
|---|---|---|
| Suspicious instructions/scripts/dependencies? | Strong fit: static rules, AST/taint analysis, dependency checks, optional semantic review. | Uses scanner output as evidence, but does not replace scanning. |
| What may the skill read/write/do/remember? | Can flag risks, but does not define the operating contract. | Primary fit: permission manifest + review workflow. |
| Should the skill be installed, listed, sold, delegated, sandboxed, or rejected? | Produces findings. | Produces verdict: install, install with limits, ask for changes, reject, or review manually. |
| Are receipts, rollback, exceptions, and evals defined? | Partial/indirect. | Primary fit. |

## Combined workflow

1. Pin provenance: source URL, commit/hash, vendor identity, version, install scope.
2. Scan with SkillSpector or equivalent before exposing secrets, files, browsers, SaaS, or memory.
3. Write the permission manifest: allowed reads, writes, tools, memory updates, outbound actions, spend, and approval gates.
4. Score with the Agent Skill Safety Scorecard.
5. Disposition scanner findings: fix, suppress-with-reason, sandbox, or reject.
6. Decide launch verdict: install, install with limits, ask for changes, reject.

## Free artifacts

- Agent Skill Safety Kit: https://jarvislandingdeploy.vercel.app/agent-skill-safety-kit.html
- Scorecard: https://jarvislandingdeploy.vercel.app/agent-skill-safety-scorecard.html
- Permission manifest template: https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest-template.html
- Permission manifest validator: https://jarvislandingdeploy.vercel.app/agent-skill-permission-manifest-validator.html
- Sample mini-report: https://jarvislandingdeploy.vercel.app/agent-skill-safety-sample-report.html

If the skill has real browser/file/SaaS/customer/memory authority and the free review exposes gaps, use the $29 Custom Agent Audit Mini-Report. For low-authority skills, the free kit is enough.