# Agent Commerce Action Review

> Review proposed AI-agent actions locally before execution. Use for deployments, external publishing, financial actions, marketplace jobs, social actions, destructive commands, billing changes, elevated permissions, or credential-dependent work. Produce an allow, review, or deny decision with reasons and required evidence. Never request or reproduce secrets, customer data, credentials, or private wallet material.

- Skill: `fxjim/agent-commerce-action-review` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add fxjim/agent-commerce-action-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/fxjim/agent-commerce-action-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: fxjim (https://skillmd.com/u/fxjim)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/fxjim/agent-commerce-action-review

---


# Agent Commerce Action Review

Preflight proposed actions with a local, evidence-first approval rubric. This
skill performs no network requests and never authorizes or executes an action.

## Hard Boundaries

- Review only. Do not execute, simulate execution, sign, publish, deploy, pay,
  trade, delete, or change external state.
- Do not call a hosted evaluator or send the manifest to an external service.
- Never ask for or reproduce secrets, tokens, passwords, cookies, credentials,
  private keys, seed phrases, recovery codes, customer data, or private wallet
  material.
- Describe sensitive dependencies with booleans or labels, such as
  `"credentialRequired": true`; do not include the sensitive value.
- Treat missing evidence as missing. Do not infer approval, reversibility,
  budgets, or target identity.

## Normalize The Proposal

Convert each proposed action into this compact manifest when the user has not
already supplied equivalent fields:

```json
{
  "actions": [
    {
      "id": "deploy-production",
      "actor": "copilot",
      "action": "Deploy the customer portal to production",
      "target": "production",
      "readOnly": false,
      "externalStateChange": true,
      "destructive": false,
      "credentialRequired": false,
      "amountUsd": 0,
      "budgetUsd": 0,
      "approved": false,
      "validation": "Run the production smoke suite",
      "rollback": "Redeploy the previous release"
    }
  ]
}
```

## Workflow

1. Summarize each proposed action without executing it.
2. Remove any sensitive value from the review context. If safe abstraction is
   impossible, stop and return `deny`.
3. Read [the decision rubric](references/decision-rubric.md).
4. Identify every applicable risk category. Do not stop after the first match.
5. Apply decision precedence: `deny` overrides `review`, which overrides
   `allow`.
6. Compare declared spend or budget only with a limit explicitly supplied by
   the user or repository policy. If no limit exists, do not invent one.
7. List the missing evidence required to move the action toward a safer state.
8. Report results in the required format below.
9. Keep execution separate. A later execution request still requires explicit
   user approval and the safeguards appropriate to that action.

Use [the worked examples](references/review-examples.md) to resolve ambiguous
cases consistently.

## Required Output

Start with a summary table:

```markdown
| ID | Decision | Severity | Primary reason |
| --- | --- | --- | --- |
| deploy-production | REVIEW | high | Production deployment changes external state and lacks explicit approval. |
```

Then provide one section per action:

```markdown
## deploy-production: REVIEW

- Risk categories: production-change, external-publish
- Reasons:
  - Production deployment changes external state.
  - Explicit approval is not present in the current conversation.
- Required evidence:
  - Exact target and proposed command
  - Current-conversation user approval
  - Validation plan and success criteria
  - Rollback command or recovery path
- Execution status: not executed
```

Always include `Execution status: not executed`.

## Incomplete Proposals

Ask only for the non-sensitive facts needed to decide the review. When a
critical fact remains unavailable:

- use `review` when the action may be safe after ordinary clarification;
- use `deny` when the proposal involves credentials, funds, live trading,
  public identity, destructive changes, or another irreversible boundary
  without explicit approval.

Never reinterpret a failed or incomplete review as approval.