Manual-Only Skills: Locking Agent Actions to Humans

Where this fits

When your agent has tools for destructive or privileged operations, the default "act first, ask later" behavior can be dangerous. You want to keep a skill visible and documented but make it impossible for the model to call it on its own. This skill does exactly that: it publishes a manual-only command that only a human can trigger, so it stays out of autonomous loops.

Why agents benefit

• The model can see the skill exists but is blocked from auto-invoking it, lowering the risk of unintended side effects.
• A human can still invoke it with /skill:disable-model-invocation, so emergency actions don't require editing agent config mid-task.
• It creates a clear permission boundary in the skill registry without building a separate approval system.
• It works as a reusable demonstration of the disable-model-invocation flag, making it easy to copy into your own skills.
• It lets agents surface the skill as a suggestion to the user instead of executing it, keeping the human in the loop.

Practical scenarios

Production database rollback

A developer asks the agent to investigate a bad migration. The agent suggests a rollback skill but cannot run it; the developer reviews the command and invokes /skill:disable-model-invocation only after confirming.

Sensitive customer-data export

While debugging a support issue, the agent could retrieve customer data but the skill is manual-only. The operator triggers it in a controlled session instead of letting the model pull data during a normal exploration.

Break-glass incident runbook

In an outage, an operator needs to restart infrastructure or revoke tokens. The manual-only skill remains available as a documented command, so the human can execute it quickly while the agent focuses on diagnosis.

Add it to your agent workflow

Install the skill with:

npx skills add Wholiver/metis --skill disable-model-invocation

After installation, the skill is registered but the model will not invoke it. To use it, the human enters:

/skill:disable-model-invocation

No special configuration is required beyond keeping the skill in your agent's skill directory.

Compare before adopting

Before making this part of every agent setup, compare it with:

• Quality signals: Check the repo's issue tracker and usage examples for how the flag is parsed by different agent runtimes.
• Maintenance freshness: The skill is small, so look at recent commits to see whether it still tracks changes in skill-loader behavior.
• Alternatives: Some runtimes support permission rules, read-only mode, or manual approval prompts; decide whether a separate manual-only skill is cleaner than those.
• Workflow fit: This is most useful for high-risk commands. If you need every action gated, a broader policy layer may be better.

Why it is worth tracking

The pattern is more important than the code: it shows how to separate what the agent knows about from what the agent can do. That distinction is essential for production agents. With 134 stars and a simple, focused README, it's a good signal that developers want explicit human-in-the-loop controls. It is worth evaluating when you design permission boundaries for irreversible actions. You can track it on OpenAgentSkill alongside other agent skills at https://www.openagentskill.com/skills/wholiver-disable-model-invocation.