Review proposed AI-agent actions and human-approval packets before consequential execution. Use this skill when checking deployments, commands, purchases, messages, credential operations, data mutations, approval freshness, action binding, replay, reviewer independence, forged evidence, or stale monitoring.
Treat a proposed action or approval screen as a claim, not proof; verify the complete decision path and produce an evidence-based review without executing or authorizing anything.
When to invoke
"Verify this agent action before I approve it."
"Check whether this deployment approval still matches the exact action."
"Audit this tool call for replay, parameter swaps, or forged evidence."
"Review this human-approval packet for a credential operation."
"Tell me if this action is eligible for human decision."
Safety boundary
Never execute, approve, sign, send, purchase, deploy, or mutate anything.
Never convert this review into execution authority.
Never infer missing evidence, identities, timestamps, or parameters.
Treat a valid schema, checksum, or signature as insufficient by itself.
Treat signatures as evidence of attribution and integrity, not factual truth.
Keep supporting and refuting evidence separate; do not average conflict away.
Fail closed on a material mismatch. Use INCONCLUSIVE when required evidence is unavailable.
Set execution_authorized to false in every final result.
{"execution_authorized": false}
Review packet
Request only artifacts needed for the review and list missing fields before analysis:
Artifact
Required details
Original request
User or system request that caused the proposed action.
Exact proposed action
Operation or tool name, target resource, complete parameters, filesystem scope, network scope, maximum execution count, not-before time, and expiry time.
Assessment
Claimed justification and canonical result.
Evidence and policy
Source evidence and policy used by the assessment.
Approval record
Approver identity, role, action digest, nonce, audience, issue time, expiry, and use count.
Monitoring
Latest events, expected heartbeat interval, signatures or integrity evidence.
Time and replay state
Current trusted time and prior nonce-use record.
Exact action identity
Build one normalized action object without dropping fields. Use the project canonicalization and digest algorithm when supplied; otherwise report the digest as NOT_VERIFIED and compare fields structurally.
Evaluate every control as PASS, FAIL, INCONCLUSIVE, or NOT_APPLICABLE.
Control
Required review
Fail or inconclusive conditions
Recomputed assessment
Re-run the declared deterministic evaluator from declared source inputs when implementation is available; compare the complete canonical result.
FAIL if recomputation differs. INCONCLUSIVE for schema validation, internal checksum, or unverifiable evaluator claim only.
Exact action binding
Compare the proposed action with the action bound into approval, including normalized object and digest.
FAIL if any material field changed or broad scope exceeds justified evidence.
Replay and identity
Verify nonce uniqueness, subject, audience, issuer, approver role, issue time, not-before time, expiry, maximum use count, and revocation.
FAIL for reused nonce, wrong audience, expired approval, future-dated approval, excessive use count, revoked identity, or role mismatch. INCONCLUSIVE without trustworthy replay store or time source.
Reviewer independence
Compare reviewers by model, provider, prompt, retrieval, tools, and operator.
FAIL when policy requires independent approval and the independent set is too small.
Evidence completeness
Inventory evidence identifiers; confirm presence, authenticity, validity window, and relevance. Track support and refutation separately.
FAIL if evidence was removed, altered, expired, or concealed in a result-changing way.
Monitoring freshness
Verify event signatures or integrity evidence, sequence numbers, previous-event digests, and heartbeat cadence.
FAIL for missing, stale, reordered, or broken-chain telemetry when policy requires continuous monitoring.
Evidence states
Support
Refutation
Epistemic state
absent
absent
UNDETERMINED
present
absent
SUPPORTED_ONLY
absent
present
REFUTED_ONLY
present
present
CONFLICTED
Never convert CONFLICTED into a numeric average that appears safe.
Challenge tests
Before finalizing, attempt these mutations mentally or with project-provided fixtures. If any mutation would pass, mark the affected control FAIL.
Replace a blocked assessment with an allowed result.
Change one approved target, parameter, scope, amount, or commit.
Reuse an otherwise valid approval nonce.
Replace independent reviewers with correlated copies.
Remove one refuting evidence item.
Stop the monitoring heartbeat after approval.
Result decision
Use exactly one result:
Result
Meaning
ELIGIBLE_FOR_HUMAN_DECISION
All required controls pass. This is not approval.
ELIGIBLE_WITH_CONTROLS
No required control fails, and explicit external controls can resolve listed conditions before execution.
BLOCKED
At least one required control fails or the action exceeds the justified scope.
INCONCLUSIVE
No required control is proven false, but evidence needed for a safe decision is missing or unverifiable.
A human authority and separate enforcement point remain responsible for any real action.
Canonicalization vocabulary
Use a project-specified canonicalization when available. Review monitoring-event signatures or integrity evidence, and treat reviewer model fine-tune lineage as part of independence analysis.
Output template
# Agent Action Review
## Result
- Review result: BLOCKED | INCONCLUSIVE | ELIGIBLE_WITH_CONTROLS | ELIGIBLE_FOR_HUMAN_DECISION
- Execution authorized: false
- Exact action digest: <verified value or NOT_VERIFIED>
## Action
- Operation:
- Target:
- Material parameters:
- Scope:
- Validity window:
- Maximum uses:
## Control matrix
| Control | Status | Evidence | Reason |
|---|---|---|---|
| Recomputed assessment | PASS/FAIL/INCONCLUSIVE/N/A | ... | ... |
| Exact action binding | ... | ... | ... |
| Replay and identity | ... | ... | ... |
| Reviewer independence | ... | ... | ... |
| Evidence completeness | ... | ... | ... |
| Monitoring freshness | ... | ... | ... |
## Supporting evidence
- ...
## Refuting evidence and defeaters
- ...
## Required next action
- State the smallest concrete step that could change the result.
## Boundaries
- State what this review did not prove.
Quality gate
No action was executed, approved, signed, sent, purchased, deployed, or mutated.
Missing packet fields were listed before analysis.
The exact action identity was normalized without dropping security-relevant fields.
Every control is marked PASS, FAIL, INCONCLUSIVE, or NOT_APPLICABLE.
Support and refutation are reported separately.
Challenge mutations were considered and any bypass marks the relevant control FAIL.
The result is exactly BLOCKED, INCONCLUSIVE, ELIGIBLE_WITH_CONTROLS, or ELIGIBLE_FOR_HUMAN_DECISION.
execution_authorized is false.
1---2name: verify-agent-action-23description: Review proposed AI-agent actions and human-approval packets before consequential execution. Use this skill when checking deployments, commands, purchases, messages, credential operations, data mutations, approval freshness, action binding, replay, reviewer independence, forged evidence, or stale monitoring.4---56# Verify agent action78Treat a proposed action or approval screen as a claim, not proof; verify the complete decision path and produce an evidence-based review without executing or authorizing anything.910## When to invoke1112- "Verify this agent action before I approve it."13- "Check whether this deployment approval still matches the exact action."14- "Audit this tool call for replay, parameter swaps, or forged evidence."15- "Review this human-approval packet for a credential operation."16- "Tell me if this action is eligible for human decision."1718## Safety boundary1920- Never execute, approve, sign, send, purchase, deploy, or mutate anything.21- Never convert this review into execution authority.22- Never infer missing evidence, identities, timestamps, or parameters.23- Treat a valid schema, checksum, or signature as insufficient by itself.24- Treat signatures as evidence of attribution and integrity, not factual truth.25- Keep supporting and refuting evidence separate; do not average conflict away.26- Fail closed on a material mismatch. Use `INCONCLUSIVE` when required evidence is unavailable.27- Set `execution_authorized` to `false` in every final result.2829```json30{"execution_authorized": false}31```3233## Review packet3435Request only artifacts needed for the review and list missing fields before analysis:3637| Artifact | Required details |38| --- | --- |39| Original request | User or system request that caused the proposed action. |40| Exact proposed action | Operation or tool name, target resource, complete parameters, filesystem scope, network scope, maximum execution count, not-before time, and expiry time. |41| Assessment | Claimed justification and canonical result. |42| Evidence and policy | Source evidence and policy used by the assessment. |43| Approval record | Approver identity, role, action digest, nonce, audience, issue time, expiry, and use count. |44| Monitoring | Latest events, expected heartbeat interval, signatures or integrity evidence. |45| Time and replay state | Current trusted time and prior nonce-use record. |4647## Exact action identity4849Build one normalized action object without dropping fields. Use the project canonicalization and digest algorithm when supplied; otherwise report the digest as `NOT_VERIFIED` and compare fields structurally.5051```json52{53 "operation": "git.push",54 "target": "owner/repository",55 "parameters": {56 "branch": "fix/example",57 "commit": "40-character-sha",58 "remote": "origin"59 },60 "filesystem_scope": [],61 "network_scope": ["github.com:443"],62 "execution_count": 1,63 "not_before": "RFC3339 timestamp",64 "expires_at": "RFC3339 timestamp"65}66```6768Never normalize away branch, commit, repository, environment, recipient, amount, currency, host, recursive, force, overwrite, privileged, destructive, dry-run flags, filesystem roots, CIDRs, ports, domains, execution counts, or expiry.6970## Six controls7172Evaluate every control as `PASS`, `FAIL`, `INCONCLUSIVE`, or `NOT_APPLICABLE`.7374| Control | Required review | Fail or inconclusive conditions |75| --- | --- | --- |76| Recomputed assessment | Re-run the declared deterministic evaluator from declared source inputs when implementation is available; compare the complete canonical result. | `FAIL` if recomputation differs. `INCONCLUSIVE` for schema validation, internal checksum, or unverifiable evaluator claim only. |77| Exact action binding | Compare the proposed action with the action bound into approval, including normalized object and digest. | `FAIL` if any material field changed or broad scope exceeds justified evidence. |78| Replay and identity | Verify nonce uniqueness, subject, audience, issuer, approver role, issue time, not-before time, expiry, maximum use count, and revocation. | `FAIL` for reused nonce, wrong audience, expired approval, future-dated approval, excessive use count, revoked identity, or role mismatch. `INCONCLUSIVE` without trustworthy replay store or time source. |79| Reviewer independence | Compare reviewers by model, provider, prompt, retrieval, tools, and operator. | `FAIL` when policy requires independent approval and the independent set is too small. |80| Evidence completeness | Inventory evidence identifiers; confirm presence, authenticity, validity window, and relevance. Track support and refutation separately. | `FAIL` if evidence was removed, altered, expired, or concealed in a result-changing way. |81| Monitoring freshness | Verify event signatures or integrity evidence, sequence numbers, previous-event digests, and heartbeat cadence. | `FAIL` for missing, stale, reordered, or broken-chain telemetry when policy requires continuous monitoring. |8283## Evidence states8485| Support | Refutation | Epistemic state |86| --- | --- | --- |87| absent | absent | `UNDETERMINED` |88| present | absent | `SUPPORTED_ONLY` |89| absent | present | `REFUTED_ONLY` |90| present | present | `CONFLICTED` |9192Never convert `CONFLICTED` into a numeric average that appears safe.9394## Challenge tests9596Before finalizing, attempt these mutations mentally or with project-provided fixtures. If any mutation would pass, mark the affected control `FAIL`.97981. Replace a blocked assessment with an allowed result.992. Change one approved target, parameter, scope, amount, or commit.1003. Reuse an otherwise valid approval nonce.1014. Replace independent reviewers with correlated copies.1025. Remove one refuting evidence item.1036. Stop the monitoring heartbeat after approval.104105## Result decision106107Use exactly one result:108109| Result | Meaning |110| --- | --- |111| `ELIGIBLE_FOR_HUMAN_DECISION` | All required controls pass. This is not approval. |112| `ELIGIBLE_WITH_CONTROLS` | No required control fails, and explicit external controls can resolve listed conditions before execution. |113| `BLOCKED` | At least one required control fails or the action exceeds the justified scope. |114| `INCONCLUSIVE` | No required control is proven false, but evidence needed for a safe decision is missing or unverifiable. |115116A human authority and separate enforcement point remain responsible for any real action.117118## Canonicalization vocabulary119120Use a `project-specified` canonicalization when available. Review `monitoring-event` signatures or integrity evidence, and treat reviewer model `fine-tune` lineage as part of independence analysis.121122## Output template123124```markdown125# Agent Action Review126127## Result128- Review result: BLOCKED | INCONCLUSIVE | ELIGIBLE_WITH_CONTROLS | ELIGIBLE_FOR_HUMAN_DECISION129- Execution authorized: false130- Exact action digest: <verified value or NOT_VERIFIED>131132## Action133- Operation:134- Target:135- Material parameters:136- Scope:137- Validity window:138- Maximum uses:139140## Control matrix141| Control | Status | Evidence | Reason |142|---|---|---|---|143| Recomputed assessment | PASS/FAIL/INCONCLUSIVE/N/A | ... | ... |144| Exact action binding | ... | ... | ... |145| Replay and identity | ... | ... | ... |146| Reviewer independence | ... | ... | ... |147| Evidence completeness | ... | ... | ... |148| Monitoring freshness | ... | ... | ... |149150## Supporting evidence151- ...152153## Refuting evidence and defeaters154- ...155156## Required next action157- State the smallest concrete step that could change the result.158159## Boundaries160- State what this review did not prove.161```162163## Quality gate164165- [ ] No action was executed, approved, signed, sent, purchased, deployed, or mutated.166- [ ] Missing packet fields were listed before analysis.167- [ ] The exact action identity was normalized without dropping security-relevant fields.168- [ ] Every control is marked `PASS`, `FAIL`, `INCONCLUSIVE`, or `NOT_APPLICABLE`.169- [ ] Support and refutation are reported separately.170- [ ] Challenge mutations were considered and any bypass marks the relevant control `FAIL`.171- [ ] The result is exactly `BLOCKED`, `INCONCLUSIVE`, `ELIGIBLE_WITH_CONTROLS`, or `ELIGIBLE_FOR_HUMAN_DECISION`.172- [ ] `execution_authorized` is false.
Run npx skillmds@latest add paulasilvatech/verify-agent-action-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Review proposed AI-agent actions and human-approval packets before consequential execution. Use this skill when checking deployments, commands, purchases, messages, credential operations, data mutations, approval freshness, action binding, replay, reviewer independence, forged evidence, or stale monitoring. It is listed under AI & ML on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
paulasilvatech (@paulasilvatech) published this skill. Their other Agent Skills are listed on their SkillMD profile.
paulasilvatech