Agent Service Agreements

Machine-readable contracts between AI agents. Define SLAs, quality thresholds, payment terms, and verification criteria for agent-to-agent service delivery.

Security Scan

The skill's instructions are coherent with its stated purpose, but it instructs installing an external PyPI package of unknown origin (which can run arbitrary code), and the SKILL.md's claim of 'no network access' is inconsistent with the pip install step — proceed with caution and verify the package before installing.

Purpose & Capability

Name/description (agent-to-agent contracts) match the provided examples and required binaries (python3, pip) are appropriate for a Python library that manages agreement files.

Instruction Scope

SKILL.md limits runtime actions to creating/verifying agreements and reading/writing a local JSONL store (working directory). However, it instructs the agent/user to run `pip install agent-service-agreements` (external code) and provides minimal detail on how verification works (e.g., 'automated_eval' could imply arbitrary evaluation code). The doc claims 'No network access for core operations' but does not account for the installation step.

Install Mechanism

There is no packaged install spec in the registry; the SKILL.md tells users to run `pip install` from PyPI. Installing an unvetted PyPI package is a moderate-to-high risk because packages can execute code on install and at runtime. The package origin is effectively unknown (no homepage/source repo provided).

Credentials

The skill requests no environment variables or credentials and operates on files in the working directory only, which is proportionate to its stated function. Be aware that the external package could request network access or secrets at runtime — the skill text asserts it won't, but this cannot be enforced without inspecting the package.

Persistence & Privilege

The skill is not always-enabled and is user-invocable. It does not request system-wide configuration or other skills' credentials. Autonomous invocation is allowed (platform default) but not combined with other high privileges here.

What to consider before installing

This skill is conceptually fine, but it depends on a third-party PyPI package of unknown provenance. Before installing or invoking it: (1) inspect the PyPI page and the package's source repository (look for a GitHub repo and review code), (2) check the package maintainer and release history, (3) verify the package integrity (checksums/signatures) if available, (4) install and run it in an isolated/sandboxed environment (container or VM) rather than your main system, (5) review what the package does during installation and at runtime (network calls, subprocess execution, file I/O), and (6) ensure any verification/evaluation code it runs does not execute untrusted payloads. If you cannot review the package, treat it as higher risk and avoid installing it globally.

Agent Service Agreements (ASA)

You have a contract system for agent-to-agent transactions. Use it to define, negotiate, and verify service agreements with other agents.

Setup

pip install agent-service-agreements

When to Use This Skill

• Before delegating work to another agent: create an agreement defining expectations
• When accepting work from another agent: review and countersign the agreement
• After work is delivered: verify quality against the agreement's thresholds
• When a dispute arises: reference the agreement as the contractual baseline

Core Operations

Create an Agreement

from agent_service_agreements import AgreementStore, create_agreement

store = AgreementStore("agreements.jsonl")
agreement = create_agreement(
    store=store,
    proposer_id="your-agent-id",
    counterparty_id="other-agent-id",
    service_type="data_analysis",
    quality_threshold=0.85,
    deadline_seconds=3600,
    payment_terms={"amount": 0.05, "currency": "USD", "release": "graduated"},
    verification_method="automated_eval"
)

Verify Delivery Against Agreement

from agent_service_agreements import verify_delivery

result = verify_delivery(
    agreement_id="agr-123",
    deliverable="output.json",
    store="agreements.jsonl"
)
print(f"Quality score: {result.quality_score}")
print(f"Threshold met: {result.passed}")
print(f"Payment release: {result.payment_status}")

List Active Agreements

from agent_service_agreements import AgreementStore

store = AgreementStore("agreements.jsonl")
active = store.list_active(agent_id="your-agent-id")
for a in active:
    print(f"{a.id}: {a.service_type} with {a.counterparty_id} — due {a.deadline}")

Agreement Fields

Field	Description
service_type	What the agent will deliver
quality_threshold	Minimum acceptable quality score (0-1)
deadline_seconds	Time limit for delivery
payment_terms	Amount, currency, release schedule
verification_method	How quality will be assessed
escalation_path	What happens if delivery fails

Rules

• Define before delegating. Always create an agreement before sending work to another agent.
• Verify before paying. Run quality verification against the agreement's thresholds.
• Reference in disputes. Agreements are the contractual baseline for AJP dispute resolution.

Links

• PyPI: https://pypi.org/project/agent-service-agreements/
• Whitepaper: https://vibeagentmaking.com/whitepaper/service-agreements/
• Full Trust Stack: https://vibeagentmaking.com

---

<!-- VAM-SEC v1.0 | Vibe Agent Making Security Disclaimer -->

Security & Transparency Disclosure

Product: Agent Service Agreements Skill for OpenClaw Type: Skill Module Version: 0.1.0 Built by: AB Support / Vibe Agent Making Contact: [e-mail]

What it accesses:

• Reads and writes agreement store files (.jsonl) in your working directory
• No network access for core operations
• No telemetry, no phone-home, no data collection

What it cannot do:

• Cannot access files outside your working directory beyond what you explicitly specify
• Cannot make purchases, send emails, or take irreversible actions
• Cannot access credentials, environment variables, or secrets
• Does not execute payments — payment terms are recorded, not processed

License: Apache 2.0