Template Safety Card: the seven-part card and a ten-check card scan (free sample)
by PaperChaseWebb
From Template Safety Card: the blank seven-part card, ten rules to paste into your agent, and a read-only script that runs ten checks on one template folder, from no card and a missing section to a network call, a send or a payment the card never mentions, a flag that turns off asking, a key in the files, a test row with no date or numbers and a safety promise.
- Price
- Free
- Difficulty
- Beginner
- Setup
- 5 min
- Format
- .md file
template-safety-card-seven-part-card-ten-check-scan-free-sample.md · 12 KB · direct download, no signup
What you end up with
You can see whether a template's card says what its files really do before you sell or share it.
What you get
- Why a template needs a card
- The blank seven-part SAFETY-CARD.md
- Ten rules for agents that write cards
- card_mini.py: ten read-only checks for one template folder
Who it is for
Anyone who wants a quick check that a template's card matches what its files do.
Works with
Solid chips: the agent is named in this listing's own tools list. Dashed chip: Plain Markdown, so it also pastes into other agents such as Grok Bot, Hermes, OpenClaw or Muse. We list those as compatible by format only, not as tested.
Tools needed
Cost to run: Free.
Time to result: About five minutes to a first scan
Sample prompts, free to use
Run python3 card_mini.py on my template folder [folder]. List every finding and tell me which card row to add or fix. Do not change the template's files.
The card, rules and script are in the file.
Free preview of the file
# Template Safety Card: the seven-part card and a ten-check card scan (free sample) Version 1.0, 2026-11-01. By PaperChaseWebb. For anyone who sells, shares or hands a client an agent template (prompts, skills, scripts, agent files) for Grok Bot, Claude Code, Codex, Hermes or the like. One page, a blank card and one Python 3 script, standard library only, read-only: it reads one template folder, prints findings and changes nothing. It runs none of the files, sends nothing and opens no network connection. No API key, no login. Tested on Linux with Python 3.13, 3.12, 3.11, 3.9 and 3.8: 6 unit tests, and 17 of 17 planted faults caught. The example template and seller are made up. ## Why a template needs a card Buyers now ask what a template can do before they install it. The seller knows best, and usually says nothing, or says "works with every agent, 100% safe". A short card in the template folder answers the questions that matter: what it can touch, what waits for the buyer's yes, what it never does, which secrets it needs, what it was really tested on, and what it was not. Cards slip in the same few ways: - The script calls a web service and the card never says so. - Texts or emails go out and nothing says who says yes first. - A setup file turns off the agent's own asking. - A key is pasted into a file. - "Tested on Hermes: works great", with no date and no numbers. - "100% safe." ## Rules to paste into AGENTS.md, CLAUDE.md, a Grok Bot standing order or Hermes notes 1
Test record
- Date
- Nov 1, 2026
- What was run
- tests/test_mini.py (6), 17 planted faults against card_mini.py, and the copy extracted from the sample page. Linux, Python 3.13, 3.12, 3.11, 3.9 and 3.8.
- Result
- 6 passed, 0 failed on all five versions; 17 of 17 faults caught; the extracted copy was identical to the tested script and found 3 problems on the example template and 0 on the clean one.
- Not run
- The hash binding, the full card against template checks, the listing check, the fix check and the eval set (the full kit does those).
Copied from this item's dated test notes. What was not run stays in.
Worth knowing
- The sample checks one folder for ten things. The hash binding, host, secret, count and test log checks, the listing and fix checks, the eval set, owner approval and agent setups are in the full kit.
- Not a security audit. It does not say a template is safe.
- On 2026-11-01 card_mini.py passed 6 unit tests and 17 of 17 planted faults on Linux with Python 3.13, 3.12, 3.11, 3.9 and 3.8, and the copy extracted from the sample page was identical to the tested script.
Questions
Does it change my files or run my template?
No. It reads the folder you name as text and prints findings. It runs nothing, opens no network connection and changes nothing.
What is in the full kit?
The card tied to your files' hash and checked against every touch, host, secret, count and test log, a listing check, a fix check for agent edits, owner approval at a terminal, an eval set, and setup for Grok Bot, Claude Code, Codex and Hermes. $24.
Details
Version 1.0 · Updated Nov 1, 2026 · Markdown version of this page
License: Personal and commercial use. Download terms
Related
Template Safety Card: what it can touch, what needs your yes, what it was tested on
One honest page for every agent template you sell or share: what it can touch, what waits for the buyer's yes, what it never does, which secrets it needs and what it was really tested on. A checker fails the template when the card is missing or does not match the files: a network call the card never mentions, texts sent with no yes, a key name left off, 25 prompts claimed for 3, a test row with no saved log, a card from an older version. It checks your listing against the card too. You approve each card at your own terminal.
Vet Before You Install: the twelve checks (free sample)
The seat sort and the twelve checks to run before any third-party skill, plugin, MCP server, repo or model touches a real machine, plus one prompt and the decision line. Updated to v1.1.
The skill card and the three-skill split (free sample)
A SKILL.md card template with Done means, May not and an action class, the three-skill split for long jobs, two rules to paste, how to keep one copy of each skill across harnesses and a check prompt.