Only 1.8% of Agent Skills Ask for Confirmation Before Acting
The rarest sentence in the corpus is the one that stops the agent before it does something irreversible.
We scanned all 765 SKILL.md files for explicit confirmation language — phrases like "confirm before", "ask for confirmation", or "confirmation rule".
| Feature | Skills | Share |
|---|---|---|
| Any confirmation language | 14 | 1.8% |
| Failure-handling section | 60 | 7.8% |
References to assets/ | 32 | 4.2% |
References to scripts/ | 173 | 22.6% |
| States what it won't do (in the body) | 196 | 25.6% |
Fourteen. In a directory that includes trading skills that place orders, publishing skills that post to live accounts, and file-management skills that move and delete things.
The confound, stated first
Of those 14, the ones we can trace come disproportionately from skills the import pipeline tagged as operate or critical risk — the generator we built for /create inserts confirmation rules automatically when the author selects those risk levels. So part of the 1.8% is our own prompt doing the work, not authors deciding to.
That does not change the conclusion. It sharpens it: left to their own devices, almost nobody writes the confirmation step. It appears when a tooling default forces it.
Why it matters more than it looks
A skill's dangerous moment is not a clever injection. We measured that separately: injection hidden inside artifacts failed about 2% of the time. The failure mode that works is the mundane one — a request that looks like a natural continuation of the task, asking the agent to take the next step without checking.
Confirmation rules are the direct countermeasure. They convert "the agent decided to proceed" into "the agent asked". That is the difference between a mistake and an incident.
What a useful confirmation rule looks like
The bad version is a slogan:
> Always be careful with destructive operations.
The useful version is a gate with an object, an action, and a waiting condition:
> Before any write, delete, publish, or purchase: state the target, the exact operation, and the expected effect; then stop and wait for explicit approval. Do not proceed on the basis of a previous approval for a different target.
Three properties make it work: it names the trigger conditions, it requires the agent to state what it is about to do, and it forbids inferring consent.
The association
Skills with confirmation language average 8.99; skills without average 8.44. A 0.55-point gap — the largest of any structural feature we measured, and still smaller than our evaluator's own re-run variance of up to a full point. Treat it as a direction, not a measurement.
If you write one skill this week
Add the four lines above to any skill that writes, sends, publishes, deletes, or spends. It is the highest-value paragraph you can put in a SKILL.md, and it currently puts you in the top 2% of the corpus.
The rubric scores this under workflow design and security; the full methodology is at methodology.