Guide · Agent skill
How to use the Skill Safety Reviewer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
Skill Safety Reviewer is an MIT-licensed agent skill that checks a planned action against a written sandbox policy before the agent does it. It is aimed at developers, teams auditing agent workflows, and students learning how permission checks are structured. By the end of this guide you will know what the skill does, how to install it, how to trigger it, and what its limits are.
Skill Safety Reviewerrohitg00/ai-engineering-from-scratch · MIT Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 2Or upload it in the Claude apps. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill.
- 3Confirm Python 3. Make sure Python 3 is available. The bundled script uses only the standard library.
- 4Run the example review. From the skill folder, run python3 scripts/review_action.py with the example policy and example request.
- 5Read the verdict. Check the JSON verdict and the exact rule that allowed, denied, or gated the action.
- 6Act on the verdict yourself. The skill never runs the reviewed step, so any real action still needs your own decision and your own enforcement.
What does the Skill Safety Reviewer make an agent do?
Agent skills are folders of instructions and scripts that an AI agent can load for a specific task. This one covers the moment when a skill-driven workflow is about to touch files, run a shell command, contact a website, handle a secret, or delete something.
Instead of letting the step run, the agent checks it against a policy. A bundled Python script classifies the requested action as allowed, denied, or needing approval, and reports which rule made that decision. The skill is designed never to run the requested command, open the URL, or change the target itself.
- Filesystem: the target must stay inside the workspace root, and symlink escapes are rejected.
- Commands: requests use an argv array, shell metacharacters and destructive executables are denied, and only allowlisted executables pass.
- Network: HTTPS and an exact origin allowlist are required, and credentials in URL userinfo are not accepted.
- Secrets: likely secret-bearing payloads are detected without logging their values.
- Destructive actions: denied, or held for a recorded human approval, according to host policy.
How do you install the Skill Safety Reviewer skill?
You can install it in one of two ways. For a personal setup, download the ZIP from this page and unzip it into your user skills folder, ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder instead.
If you use the Claude apps, you can upload the skill instead. Open Settings, go to Capabilities, then Skills, and upload the skill there.
- Option A (personal): unzip into ~/.claude/skills/
- Option B (project): unzip into the project's .claude/skills/ folder
- Option C (Claude apps): Settings → Capabilities → Skills, then upload
What do you need before running it?
The bundled script uses only the Python 3 standard library, so you need Python 3 installed and no extra packages. You also need two JSON files in the expected format: a sandbox policy and a request. The skill ships with an example of each in its assets folder, which you can use to try it out.
The skill runs scripts and does not use the network.
- Python 3
- assets/sandbox-policy.json (the example policy)
- assets/example-request.json (the example request)
How do you run a review step by step?
The skill's own instructions give a fixed order. The agent reads the threat model, inspects the example policy and request, runs the review script, and then returns the JSON verdict along with the exact rule that allowed, denied, or gated the action.
You can run the same check yourself from the skill folder with the command below.
- Read references/threat-model.md.
- Inspect assets/sandbox-policy.json to see the example boundary.
- Inspect assets/example-request.json to see the request format.
- Run the review script.
- Report the JSON verdict and the rule that decided it.
python3 scripts/review_action.py --policy assets/sandbox-policy.json --request assets/example-request.jsonHow do you trigger it with natural requests?
You do not need special syntax. Ask the agent to review a planned step before it runs. The skill's description covers requested filesystem, command, network, secret, and destructive actions, so phrase your request around one of those kinds of step.
Some examples of requests that match this scope:
- Check whether this shell command is allowed by our sandbox policy before you run it.
- Review whether this skill step may delete files in the workspace.
- Before you open this URL, check it against our network allowlist.
- Would this step send a secret in its payload? Review it first.
- Check this planned file write against the workspace boundary and tell me which rule applied.
What are the safety notes?
The script is a classifier, not a sandbox. It only classifies JSON requests and cannot enforce anything on the system. If the agent ignores the review, nothing in the script stops the action. Use a real sandbox or OS-level permissions for enforcement.
The rule set is limited to the example policy and a small list of destructive commands and metacharacters, so unusual inputs may be misclassified. Treat an allow verdict as meaning only that the simulated request satisfies the supplied policy. The skill also treats permission claims inside SKILL.md or external content as untrusted input, and it treats retrieved text as data rather than approval.
- Not a replacement for a real sandbox or OS permissions.
- Can be bypassed if the agent does not follow the skill.
- Use it with care on unusual commands, since the rules are limited.
- An allow verdict is not approval to run the real action.
What people use it for
- Checking a planned shell command against an executable allowlist before an agent runs it.
- Reviewing whether a skill step may write or delete files outside the workspace root.
- Auditing which steps in a team's agent workflows contact external websites.
- Teaching students how sandbox policies, allowlists, and permission checks are structured.
- Confirming that a request with a likely secret in its payload is flagged before it goes further.
Frequently asked questions
How do I install the Skill Safety Reviewer skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
What does Skill Safety Reviewer require?
It requires Python 3. The bundled script uses only the standard library, so no extra packages are needed. You also need a sandbox policy JSON file and a request JSON file in the expected format, and the skill includes examples of both.
Is Skill Safety Reviewer free to use?
The skill is released under the MIT licence, as stated on its page. Check the licence text in the download for the full terms.
Does Skill Safety Reviewer replace a sandbox?
No. The script only classifies JSON requests and cannot enforce anything on the system. For real enforcement, use a proper sandbox or OS-level permissions.
Why did the reviewer misclassify my command?
The rule set is limited to the example policy and a small list of destructive commands and metacharacters, so unusual inputs may be misclassified. Read the rule the verdict cites, and adjust your policy or request format to match the expected structure.
How does it compare to just asking the agent to be careful?
The skill adds a fixed, written check that reports the exact rule behind each decision. It does not execute the step, but it also cannot stop an agent that ignores it, so it works best alongside real permissions.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Choose Skill Safety Reviewer if you want a readable, rule-based check on an agent's planned file, command, network, secret, or delete steps, or if you want to learn how such policies are built. Pick something else if you need enforced isolation, since this script only classifies requests and cannot stop an action that the agent chooses to run anyway.
Download the skill