How do I install the Confirm Action skill?

Run npx skillmds@latest add tomevault-io/confirm-action in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Confirm Action safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Confirm Action?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Confirm Action free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Confirm Action?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Confirm Action by tomevault-io — Agent Skill

Name: Confirm Action
Author: tomevault-io

Confirm Action

Ask the user to confirm before taking a significant action. Use before containment, remediation, or other impactful operations to ensure analyst approval. Presents options and waits for response. Use when this capability is needed.

tomevault-io Updated Sep 17, 2026

File contents

Confirm Action Skill

Ask the user a confirmation question before proceeding with a significant action.

Inputs

QUESTION_TEXT - The specific question to ask (e.g., "Isolate endpoint WORKSTATION-01?", "Proceed with account disable for jsmith?")
(Optional) RESPONSE_OPTIONS - Predefined options for the user:
- Default: ["Yes", "No"]
- Custom examples: ["Disable Account", "Reset Password", "Monitor Only"]

Workflow

Step 1: Present Question

Display the question to the user with available options.

Step 2: Wait for Response

Collect the user's selection or custom input.

Step 3: Return Response

Provide the response back to the calling workflow for decision branching.

Outputs

Output	Description
`USER_RESPONSE`	The user's answer to the confirmation question

When to Use

Always confirm before:

Isolating/quarantining endpoints
Disabling user accounts
Blocking IPs/domains at firewall
Terminating processes
Deleting files
Escalating to incident response
Closing cases as false positive (for high-severity alerts)

May skip confirmation for:

Adding comments to cases
Running enrichment queries
Generating reports
Read-only operations

Example Confirmations

Containment:

Question: "Isolate endpoint WORKSTATION-01 from the network?"
Options: ["Yes - Isolate", "No - Continue Monitoring", "Escalate First"]

Account Action:

Question: "User jsmith shows signs of compromise. What action?"
Options: ["Disable Account", "Force Password Reset", "Monitor Only", "Escalate to IR"]

Case Closure:

Question: "Close case 1234 as False Positive?"
Options: ["Yes - Close FP", "No - Keep Open", "Escalate to Tier 2"]

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: confirm-actiondescription: Ask the user to confirm before taking a significant action. Use before containment, remediation, or other impactful operations to ensure analyst approval. Presents options and waits for response. Use when this capability is needed.---# Confirm Action SkillAsk the user a confirmation question before proceeding with a significant action.## Inputs- `QUESTION_TEXT` - The specific question to ask (e.g., "Isolate endpoint WORKSTATION-01?", "Proceed with account disable for jsmith?")- *(Optional)* `RESPONSE_OPTIONS` - Predefined options for the user: - Default: `["Yes", "No"]` - Custom examples: `["Disable Account", "Reset Password", "Monitor Only"]`## Workflow### Step 1: Present QuestionDisplay the question to the user with available options.### Step 2: Wait for ResponseCollect the user's selection or custom input.### Step 3: Return ResponseProvide the response back to the calling workflow for decision branching.## Outputs| Output | Description ||--------|-------------|| `USER_RESPONSE` | The user's answer to the confirmation question |## When to Use**Always confirm before:**- Isolating/quarantining endpoints- Disabling user accounts- Blocking IPs/domains at firewall- Terminating processes- Deleting files- Escalating to incident response- Closing cases as false positive (for high-severity alerts)**May skip confirmation for:**- Adding comments to cases- Running enrichment queries- Generating reports- Read-only operations## Example Confirmations**Containment:**```Question: "Isolate endpoint WORKSTATION-01 from the network?"Options: ["Yes - Isolate", "No - Continue Monitoring", "Escalate First"]```**Account Action:**```Question: "User jsmith shows signs of compromise. What action?"Options: ["Disable Account", "Force Password Reset", "Monitor Only", "Escalate to IR"]```**Case Closure:**```Question: "Close case 1234 as False Positive?"Options: ["Yes - Close FP", "No - Keep Open", "Escalate to Tier 2"]```---> Converted and distributed by [TomeVault](https://tomevault.io/claim/dandye) — claim your Tome and manage your conversions.

Frequently asked questions