An agent capability can combine instructions, scripts, dependencies and access to another service. Its effective authority depends on what the surrounding application permits it to do. Reviewing a short description is therefore only the beginning: review the executable components, configuration, data access and update path together.
Define the object under review
A skill usually supplies reusable instructions or workflows and may include scripts. A tool exposes an operation. An MCP server supplies protocol-accessible capabilities. A plugin or connector may package several components and credentials. These categories overlap, and their names vary across platforms. Record the actual files, endpoints and granted permissions rather than assuming that a label determines safety. [Source 2]
Separate content from authority
Prompt injection can place adversarial instructions in material an agent is asked to read. Tool results, retrieved pages and repository files should be treated as input data, not as authority to change the user’s objective or grant access. The ultimate boundary should be enforced by application policy, authorization and isolation, with human approval where the action warrants it. [Source 3]
Review before admission
Identify the publisher and the exact revision. Examine dependency sources and installation behavior. Map every requested permission to a task requirement, including network destinations and writable paths. Ask who can change the package or an instruction it loads after admission. A version pin on one file does not pin a remote instruction source.
OWASP’s skill guidance groups risks around supply chains, privilege, isolation and governance. Its project was marked as a public-review v1 when checked. Use it as one evolving reference; this website’s review is an independent educational workflow, not a substitute for the project’s own guidance. [Source 2]
Enforce during execution
Use a distinct identity where feasible and narrow the resources it can access. Check tool arguments as well as the tool name. Restrict the filesystem, subprocesses and network at the execution boundary. A prompt telling an agent to behave carefully cannot substitute for a permission that is denied by the system. Anthropic’s sandboxing discussion illustrates filesystem and network controls in one implementation. [Source 4]
Collect useful evidence
Record who invoked the capability, what operation policy permitted, the relevant version, the resources touched and the result. Exclude secrets and unnecessary content from logs. Identify a named owner for exceptions and an expiry date. A review without an inventory or a revocation path becomes stale when the deployment changes.
Use the review tool
The skill review asks eight questions about essential controls. It counts documented answers and identifies missing evidence. Two admission conditions take precedence over the count. The result offers a next review step; it does not scan a package, perform a penetration test or certify security.