Python skill tool read-only auto-approval versus script execution approval
Does approving read-only Microsoft Agent Framework skill tools also approve script execution?
For the documented Python SkillsProvider with ToolApprovalMiddleware, the read_only_tools_auto_approval_rule covers load_skill and read_skill_resource while run_skill_script still requires approval. The all_tools_auto_approval_rule includes script execution.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not treat a read-only approval rule as script authorisation, or assume middleware is installed from the skill manifest alone.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Remote MCP archive resource discovery versus executable script capability
Can a downloaded Microsoft Agent Framework MCP skill archive execute its bundled scripts?
The documented archive-type MCP skill path exposes extracted resources but does not execute bundled scripts. File-based scripts and remote archive resources have different execution treatment.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not infer local script execution from successful archive discovery; another installation path needs a separate review.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Demonstration subprocess runner versus effective host isolation
Does registering an Agent Framework subprocess skill runner establish a sandbox?
Microsoft marks the example subprocess runners as demonstrations and recommends separate isolation, resource limits, input validation and audit controls for production.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Refuse to equate runner registration with filesystem, network or resource isolation; review the actual host controls.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Ignored custom frontmatter and experimental allowed-tools versus enforced policy
Can a custom Agent Framework SKILL.md field establish an enforced review policy?
The documented parser rejects certain malformed recognised fields but ignores unknown top-level fields. The allowed-tools field is experimental and support can vary across implementations.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not rely on an unrecognised policy key or experimental declaration as enforced permission; require the consumer's interpretation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Responses default_version versus latest_version selection
Which OpenAI Responses skill version is selected when no explicit version is supplied?
The documented Responses Skills API uses default_version for an omitted version and separately tracks latest_version. An explicit version or latest reference has a different update boundary.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not transfer Anthropic's omitted-version rule to OpenAI; bind the reviewed version and bytes before approval.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Upload acknowledgement versus version retrieval readiness
Does an OpenAI skill upload response prove that the new version can already be attached?
The guide says a newly uploaded version can briefly return 404. It instructs callers to retrieve the version with bounded backoff before attachment and use the returned version string.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Treat upload acceptance and retrieval readiness as separate evidence; do not silently fall back to another version.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Hosted skill_reference versus local path/byte identity
Can a hosted OpenAI skill_reference identify the skill used by local shell execution?
The documented hosted shell accepts uploaded skill_reference attachments; local shell instead uses skill files at paths in the runtime controlled by the application.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- A hosted skill ID does not bind local file bytes; capture the local bundle and runtime mapping separately.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agents API discovery directories versus filesystem authority
Does registering an Agents API capability directory limit all filesystem access to that directory?
Capability directories identify existing absolute, unique sandbox paths for skill discovery; the guide disallows dot path segments and limits registration to 32 directories. Discovery paths are not documented as a general filesystem permission boundary.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not infer containment from directory registration; separately review effective sandbox filesystem permissions.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Trusted credential broker versus secrets injected into generated-code environment
Does putting a credential in a secrets manager prevent a skill from reading it at runtime?
OpenAI distinguishes credentials kept outside execution and supplied by a trusted proxy from secrets injected into the environment, which remain exposed to generated code. Its executor environment key is also readable inside that environment.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not claim secret isolation from storage alone; identify actual injection, proxy destinations and environment-key scope.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Enterprise scanner eligibility/channel/timing coverage
Does enabling Claude Enterprise skill scanning cover API uploads and existing skills?
The captured guidance limits scanning to eligible uploads and edits in claude.ai or Cowork after the setting is enabled. It excludes Skills API uploads and skills already present when scanning was enabled. The guide also excludes organisations with certain data-handling configurations, including CMEK, ZDR or HIPAA readiness.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not represent the organisational switch as retrospective or API-wide coverage; inventory each deployment channel and scan event.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Usability versus clean scan, warnings and authorised overrides
Does a usable Claude skill prove that it passed scanning without an exception?
The guide says pending or failed scans block use, warning results can remain usable behind a caution notice, and authorised owners or library-managing roles can allow some failed skills.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Usability alone does not establish a clean scan; record outcome, warning and any authorised exception separately.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Claude API omitted-version promotion boundary, distinct from OpenAI default
Can an unpinned Claude Skills API reference remain tied to a previously approved upload?
The captured enterprise guidance says omitted versions use the latest version and workspace uploads can therefore change what production agents run. It recommends explicit version pinning and evaluation before promotion.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not carry approval across an unreviewed upload; bind the deployed version and checksum with a rollback reference.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Triggering/coexistence qualification versus isolated demonstration
Does a skill's successful isolated demonstration establish safe selection alongside existing skills?
The enterprise guide calls for isolated and coexistence evaluations covering triggering accuracy, output quality and regressions across the active skill set, separately from security review.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not promote solely from one successful demonstration or a scanner result; include incorrect-trigger and coexistence cases.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Malformed or ignored Claude Code frontmatter versus intended invocation restriction
Can malformed Claude Code skill frontmatter fail open to default invocation behaviour?
The captured Claude Code guide says unrecognised fields are ignored, frontmatter is read only when the opening marker is the first line, and unparseable YAML still loads the skill with no fields set.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not assume a misspelled or malformed restriction prevents loading; inspect parsed behaviour in the pinned client.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
User command visibility versus autonomous invocation authority
Does user-invocable false prevent Claude from invoking a sensitive skill?
The guide distinguishes disable-model-invocation true, which prevents autonomous invocation, from user-invocable false, which removes user invocation while allowing Claude to invoke the skill.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not confuse command visibility with prohibition of model invocation or downstream tool authority.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Local prompt preprocessing executes before model sees skill body
Can a local Claude Code skill run a shell command while constructing its prompt?
The documented exclamation/backtick syntax executes commands before the skill content is sent to Claude and substitutes their output. Synced skills have surface- and version-specific restrictions.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Include load-time commands in admission review; do not classify a skill as instructions-only because its displayed body contains substituted output.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Synced skill preprocessing differs by execution surface and client version
Can the same synced Claude skill have identical execution behaviour in cloud and local sessions?
The captured guide distinguishes cloud, Cowork and other local sessions for shell preprocessing, file references and substitutions, with relevant restrictions requiring Claude Code v2.1.228 or later.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not transfer an approval between surfaces without recording client version and the effective preprocessing rules.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Plugin component inventory includes hooks/modules/servers beyond visible skill
Does approving a plugin's visible skill cover its hooks and MCP servers?
Claude Code documents plugins containing skills, agents, lifecycle hooks, JavaScript hook modules and MCP servers. These components can expose capabilities beyond the visible slash command.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Review the entire plugin component inventory and enabled configuration; a skill-level checklist cannot attest to unreviewed hooks or servers.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Committed enablement versus collaborator-local installation bytes
Does enabling a Claude Code plugin in committed project settings install identical local code for every collaborator?
The guide distinguishes project enablement from each collaborator's local installation, while cloud sessions do not load local settings in the same way.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not infer uniform installed bytes from committed enablement; capture each relevant installation identity and session type.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Default/last-version deletion dependencies and retirement scope
Can one OpenAI skill version be retired without changing the default or remaining skill identity?
The Responses Skills guide says the default version cannot be deleted until another default is selected, deleting the last version deletes the skill, and deleting a skill removes all versions.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Plan retirement against the referenced versions and default pointer; source deletion alone does not prove mounted copies or previous outputs are erased.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Normalised namespace string controls whether IAM conditions match
Can an AgentCore namespace IAM condition omit its leading or trailing slash?
AgentCore normalises namespaces with leading and trailing slashes. The guide says an IAM condition lacking these does not match the namespace on which the service acts.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Compare the normalised runtime value with the actual IAM condition; do not diagnose effective access from a visually similar string.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
namespaceKeys update replaces full set and preserves dependent keys
Does UpdateMemory append namespace keys while retaining the previous set?
The documented namespaceKeys update replaces the entire set. The guide requires preserving existing keys and rejects removing a key still used by a strategy template.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Treat a namespace change as full-configuration replacement; compare old/new keys and all dependent strategies before approving.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Long-term expiry requires deployed/executed timestamp-based pruner in reviewed design, distinct from DeleteEvent-derived residue
Does a configured memory age prove AgentCore long-term records expire automatically?
The reviewed AWS lifecycle design implements timestamp-filtered pruning in a separate workflow and states that AgentCore memory lacks a built-in auto-delete TTL in that design context.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- A proposed TTL or event expiry is not proof that the long-term pruner ran; require its scope, execution and deletion evidence.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Private-beta ingestion retains raw transcript as well as extracted facts
Does Cloudflare Agent Memory retain only extracted facts after ingesting a conversation?
Cloudflare Agent Memory PRIVATE BETA, documentation reviewed 30 October 2026: The reviewed beta documentation says raw messages are stored verbatim alongside extracted memories and are also searched during recall.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not approve a facts-only retention claim from an extraction result; inventory raw messages as a separate retained representation. Private beta access and current feature applicability require separate confirmation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Supersession preserves old history despite latest-first recall
Does a newer Cloudflare memory fact replace and erase the previous fact?
Cloudflare Agent Memory PRIVATE BETA, documentation reviewed 30 October 2026: The beta documentation describes facts and instructions being superseded by topic key while retaining old versions; recall preferentially surfaces the latest version.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not equate supersession or absence from recall with deletion; record historical versions and their disposal evidence. Private beta access and current feature applicability require separate confirmation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Namespace/profile/session tuple versus authenticated tenant boundary
Can a Cloudflare Agent Memory session identifier alone define a tenant boundary?
Cloudflare Agent Memory PRIVATE BETA, documentation reviewed 30 October 2026: The documented hierarchy separates namespaces and profiles, with sessions scoped to a profile and the same session ID permitted in different profiles. Recall is described as confined to the selected profile.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Require the application's authenticated-identity-to-profile mapping; a session string alone does not establish tenant authorisation. Private beta access and current feature applicability require separate confirmation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Task deprioritisation after session end versus deletion
Does ending a Cloudflare Agent Memory session delete its task memories?
Cloudflare Agent Memory PRIVATE BETA, documentation reviewed 30 October 2026: The documented task class is session-scoped and deprioritised after the session ends. Deprioritisation describes retrieval treatment rather than an asserted deletion operation.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not use lower ranking as expiry evidence; identify a deletion or retention process and its results. Private beta access and current feature applicability require separate confirmation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Individual memory/source-message deletion versus whole-profile scope
Does deleting one Cloudflare memory establish deletion of its whole profile?
Cloudflare Agent Memory PRIVATE BETA, documentation reviewed 30 October 2026: The HTTP API distinguishes namespace, profile, session and individual-memory deletion. Its individual-memory description removes that memory and source messages linked to it, rather than asserting complete profile erasure.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Match the deletion target to the intended custody claim; independent exports, downstream outputs and wider profile contents require separate evidence. Private beta access and current feature applicability require separate confirmation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Content-and-session identity bounds ingestion deduplication
Does retrying Cloudflare memory ingestion always preserve the same message identity?
Cloudflare Agent Memory PRIVATE BETA, documentation reviewed 30 October 2026: The beta design derives message IDs from content and session and can derive an omitted session ID from the conversation. Its deduplication therefore depends on those inputs.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not generalise retry deduplication across changed content or session mapping; retain the original input identity and returned memory references. Private beta access and current feature applicability require separate confirmation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Documented managed delete wildcards require explicit full-project scope
Can a Mem0 user wildcard be treated as a complete project erasure?
The current documentation distinguishes scoped delete_all arguments, rejects missing/blank identifiers in SDKs, and requires all four entity filters set to wildcards for its described full-project wipe.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Bind deletion to the documented SDK/API version and exact filters; never infer all representations or external copies were erased from a scoped confirmation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Immutable memory correction requires delete/re-add, with old/new identity linkage
Can a Mem0 immutable memory be corrected with an ordinary update?
Mem0 documents immutable memories as requiring delete and re-add rather than update. Managed and OSS interfaces report the rejected update differently.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not report correction complete from an attempted update; preserve the old/new identity link and require both operation outcomes.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
SQL/vector/entity representations versus single-store exit completeness
Is a Mem0 vector-store export a complete memory custody inventory?
The reviewed architecture separates facts/metadata in SQL, embeddings in a vector database and extracted entities in an entity store; managed and OSS operation differs.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not treat one backing-store export as complete; reconcile each configured representation and its owner before exit assertions.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Metadata/expiry-only update can change retention without changing text
Can a Mem0 metadata-only update alter expiry without changing memory text?
The documented OSS update accepts metadata and/or expiration changes while retaining text, and explicitly allows clearing expiration with None/null.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Review retention fields independently of text diffs; unchanged content does not prove an unchanged expiry policy.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Checkpointer thread state versus independent cross-thread store
Does removing LangGraph thread state cover its cross-thread memories?
LangGraph documents checkpointers for thread-scoped graph snapshots and stores for separate cross-thread application data. Applications can use both.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not infer cross-thread store deletion from a thread-state action; inventory both configured systems and namespaces.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Local harness file memory versus opt-in managed Foundry facts
Does clearing a Microsoft harness local memory folder remove Foundry-extracted facts?
Microsoft distinguishes agent-written local file memory from automatically extracted managed Foundry memory. The two can be used together and have different storage and scope.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Inventory both configured memory providers; clearing a local folder cannot establish disposal of managed facts.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Mounted container-file lifetime versus separately managed uploaded skill assets
Does expiry of a hosted OpenAI skill container prove deletion of the separately uploaded skill asset?
The guide binds mounted skills and container files to the hosted container lifecycle, while separately describing uploaded skill versions and their deletion rules.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not extend the container-file statement to uploaded assets, local copies or prior outputs without separate retention evidence.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Background long-term memory write completion versus response completion; distinct from checkpoint durability modes
Does an agent response establish that its background memory write has finished?
The LangGraph guide distinguishes memory writes in the request path from background/asynchronous updates with different timing and complexity.
Documentation reviewed 2026-10-30. Primary source.
Boundaries
- Do not treat response completion as memory persistence confirmation; capture the background write outcome and the visibility point for dependent actions.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review