# Agent Skill review worksheet

Praesidia · Version 1.0 · Updated 2026-10-06

Use one copy per Skill artifact and execution environment. This worksheet is a
review record, not a standardized permission manifest or an enforced runtime
policy. Replace placeholders with evidence from the actual deployment.

## Artifact and owner

- Skill name and business purpose: [fill in]
- Publisher and verified source: [fill in]
- Immutable version, commit, or artifact digest: [fill in]
- File inventory and digest record: [attach]
- Reviewer and service owner: [fill in]
- Runtime product and version: [fill in]
- Review date and next review: [fill in]
- Decision: [pending / approve / approve with conditions / reject]

## Requested access and enforced access

Record requested capabilities separately from observed runtime permissions.

| Boundary | Requested access | Enforced restriction | Evidence | Gap and owner |
| --- | --- | --- | --- | --- |
| Filesystem reads | [paths] | [allowed roots] | [denied fixture test] | [fill in] |
| Filesystem writes | [paths] | [allowed roots] | [denied fixture test] | [fill in] |
| Network | [domains and purpose] | [egress policy] | [allowed and denied destinations] | [fill in] |
| Credentials | [identity and purpose] | [visible credentials and scope] | [disposable credential test] | [fill in] |
| Subprocesses | [executables] | [inherited permissions] | [child-process test] | [fill in] |
| External tools | [tools and actions] | [runtime policy] | [rejected action test] | [fill in] |

## Source and installation review

- [ ] Instructions, scripts, imports, dependencies, and bundled resources reviewed.
- [ ] Symlink targets and external downloads reviewed separately.
- [ ] No installer was executed merely to learn its behavior.
- [ ] Credential reads, outbound calls, writes, and consequential actions identified.
- [ ] Reviewed dependencies and execution artifact pinned where supported.
- [ ] License and publisher provenance recorded independently of file hashes.

## Runtime test record

Use synthetic data and disposable credentials. Record enforcement evidence;
a timeout or missing output alone does not prove a permission was denied.

| Test | Expected result | Observed result | Enforcement evidence | Reviewer |
| --- | --- | --- | --- | --- |
| Intended task | [fill in] | [fill in] | [fill in] | [fill in] |
| Outside-root file read | Denied | [fill in] | [fill in] | [fill in] |
| Outside-root file write | Denied | [fill in] | [fill in] | [fill in] |
| Disallowed destination | Denied | [fill in] | [fill in] | [fill in] |
| Child process boundary | Same intended restrictions | [fill in] | [fill in] | [fill in] |
| Rejected consequential action | No action occurs | [fill in] | [fill in] | [fill in] |

## Decision and follow-up

- Conditions before enablement: [fill in]
- Accepted limitations and decision owner: [fill in]
- Disablement procedure and responsible owner: [fill in]
- Review triggers: [code / dependencies / downloads / credentials / runtime permissions]
- Reviewer sign-off and evidence location: [fill in]

Full guide: https://praesidia.ai/blog/agent-skills-security-vetting-checklist

You may copy, edit, and share this worksheet. Completing it does not certify a
Skill as safe or replace validation of the runtime's actual enforcement.