You built an agent that works. Someone asks for it. What do you actually send them?
An AI agent is more than a prompt. In AWFlow (a browser automation tool I build) an agent has a model, instructions, memory, skills, rules and routines, and agents can form teams with a handoff map (the coordination runtime behind teams has its own post). We recently added a marketplace where people can share agents and whole teams as templates.
That raises a design question every "share your agent" feature has to answer: what's the reusable part, and what's personal? Get it wrong one way and templates are useless. Get it wrong the other way and people leak their memory, their sites and their credentials. Here's how we drew the line, and the rules we follow on install.
Never the person: what it knows about its author, or what it is connected to.
What travels and what stays
An agent template should carry how the agent works, never what it knows about its author or what it's connected to on the author's machine.
Drag the line to compare what travels.
Here's the full split:
| Kept (the setup) | Stripped (personal or device-specific) |
|---|---|
| Name, handle, role, avatar, greeting, starter prompts | Memory and chat history |
| Instructions | Knowledge-base contents (the collection references are emptied) |
| Skills it uses (browser, web search, on-device AI…) | Credentials and the author's MCP servers |
| Rule preset and generic per-action rules | Per-site rules and the author's allow/block site lists |
| Portable routines (schedule, page triggers…) | Routines tied to a local workflow or a recording |
| Team: members, roles, way of working, handoff map | IDs of the author's own workflows |
| On-device model choice | Cloud model choice (it names the author's provider) |
A few of these deserve a word.
Models: on-device travels, cloud doesn't
If the author picked an in-browser model, the template keeps it: anyone can download the same model. If they picked a cloud model, the template says "inherit" and the installer's own default applies. A cloud pick names the author's provider and account setup, which the installer may not have.
On install, your own default applies.
Rules: keep the intent, drop the specifics
The agent's rule preset and its generic per-action rules ("ask before submitting forms") are the safety intent, so they travel. Rules tied to specific sites, and the author's allow/block site lists, are personal browsing context, so they're dropped.
Peel them apart: the intent travels, the specifics stay home.
Dependencies become "needs", not secrets
If an agent uses one of the author's workflows as a skill, or an MCP server, the template can't include those. Instead it records what's needed: the workflow's name, the MCP server's host.
You get a plain note. After installing, the user sees “Add these to finish setting it up: …”.
The agent depends on the author's things
A workflow that lives on the author's device, an MCP server they connected. Neither can travel.
Export records the need
The template keeps the workflow's name and the server's host, so the installer knows what is missing.
Install creates the agent
The new agent starts without those tools, rather than pretending to have them.
You get a plain note
After installing, the user sees "Add these to finish setting it up: …".
That's much better than an agent that silently has fewer tools than its description promises.
Routines: only the portable ones
A routine triggered by a schedule or a page event travels. A routine that depends on a local workflow or a recorded sequence can't work on someone else's machine, so it's left out rather than shipped broken.
On install: never trust the file
A template is just data, and data from strangers is untrusted.
The rule: treat the file as untrusted input.
Install follows a few rules:
Same guardrails: "ask" asks, locked categories always ask.
The re-mapping is worth seeing, because it's where a careless importer leaks or overwrites things.
The built-in assistant is reused, not duplicated.
The marketplace on top
The marketplace adds the social layer. Listings are reviewed by a moderator before they go live, and anyone can browse agent and team templates in Marketplace › Agents & teams without signing in. Installing is one click, plus a single confirmation when the template's agents can act in your browser or run on their own. The install is counted on the server (once per signed-in person), but the agents themselves are created locally on your device.
One honest limit: stripping protects your state and your connections, not your words. Instructions are shared as written. The marketplace checks a template again when it is submitted and refuses anything that looks like a key or personal data, but read your instructions before you share. The templates page in the docs lists everything that is and isn't shared.
If you're building "share your agent" in your own product, this is the short list:
Untrusted on install: fresh IDs, remapped references, same guardrails.
AWFlow is free and runs in your browser.
Interactive version with animations: https://awflow.io/blog/sharing-an-ai-agent-what-to-strip
Try it
Agentic Workflow (AWFlow) runs in your browser, on the model you choose, free and with no account needed to start. Install it from the Chrome Web Store here.
Top comments (0)