# AI Agent Tool Safety Tester

> Design and assess authorized safety tests for AI agents that call tools or act on external systems. Use when a tester needs to verify tool allowlists, authentication, authorization, least privilege, argument validation, approval gates, dry-run behavior, tenant isolation, idempotency, rollback, or prevention of unintended and injection-triggered side effects.

- Skill: `pramoddutta/ai-agent-tool-safety-tester` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add pramoddutta/ai-agent-tool-safety-tester`
- Raw SKILL.md: https://api.skillmd.com/api/skills/pramoddutta/ai-agent-tool-safety-tester/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- License: MIT
- Author: PramodDutta (https://skillmd.com/u/pramoddutta)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/pramoddutta/ai-agent-tool-safety-tester

---


# AI Agent Tool Safety Tester

Verify the boundary between a model's proposal and an external action. Prefer mocks and
read-only dry-runs; never let a safety test create an unapproved real-world side effect.

## Workflow

1. Inventory tools, owners, schemas, credentials, permission scopes, data boundaries, approval
   rules, side effects, rollback paths, and prohibited actions from supplied artifacts.
2. Confirm written authorization, staging isolation, synthetic accounts/data, mock endpoints,
   rate limits, stop conditions, and the human who can approve each state-changing action.
3. Record the build, model/provider and version, prompt/configuration revision, agent runtime,
   tool schema/version, policy/guardrail revision, identity/role, and run ID.
4. Design cases for denied tools, excessive permissions, invalid or injected arguments,
   cross-tenant targets, skipped confirmation, repeated calls, partial failure, timeout,
   retry, cancellation, rollback, and untrusted content influencing tool selection.
5. Execute mocks first. Capture whether an action was proposed, requested, approved, blocked,
   executed, rolled back, or not tested; record exact sanitized arguments and tool responses.
6. Report observed authorization failures and side effects separately from inferred causes and
   remediation hypotheses. Require re-runs after any policy, prompt, model, or tool change.

## Evidence register

Classify every statement as `Observed`, `Inferred`, `Hypothesis`, or `Not tested`.

| Classification | Source / run ID | Expected control | Observed result | Evidence artifact | Unresolved gap |
|---|---|---|---|---|---|
| Observed / Inferred / Hypothesis / Not tested | case and tool-call ID | cited permission or approval rule | proposed, blocked, executed, rolled back, or no run | sanitized trace and state proof | side effect or recovery not verified |

Record exact build, model, prompt, policy, guardrail, agent runtime, tool schema, identity,
corpus, and environment versions. Never infer execution from a natural-language response.

--- HUMAN REVIEW GATE ---
Unverified items:
Remaining risks:
Required approver:
Decision: approve / revise / reject

## Guardrails

- Run only in an explicitly authorized staging or sandbox environment using synthetic inputs,
  identities, credentials, records, and mock tools. Obtain a human approval immediately before
  any permitted external or state-changing call.
- Never fabricate a policy, permission, approval, tool call, result, side effect, rollback,
  metric, source, trace, or evidence link. Mark absent facts and runs explicitly.
- Never claim safe, secure, compliant, least-privileged, or side-effect-free from sampled runs.
- Stop on unexpected writes, messages, purchases, deletions, permission changes, or scope escape;
  preserve evidence and escalate to the tool and security owners.