action-surface-audit

Map agent actions into risk tiers and prioritize judge boundaries.

Updated Jul 16, 2026
One-click install
npx skills add https://github.com/Cloud-Byte-Consulting/plugins --skill action-surface-audit-cloud-byte-consulting
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: action-surface-audit
Source: https://github.com/Cloud-Byte-Consulting/plugins/tree/main/prompt-workflows/skills/action-surface-audit
Command: npx skills add https://github.com/Cloud-Byte-Consulting/plugins --skill action-surface-audit-cloud-byte-consulting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams building AI agents often add tools and capabilities without a clear picture of what the agent can actually do in the world, making it hard to decide where judgment layers and human review belong. This Skill produces a structured audit of every action an agent can take so risk boundaries are explicit before judge infrastructure is built. ## Core Features & Use Cases - Action inventory: Lists every distinct action the agent can take or trigger, based on a guided interview about tools, side effects, and affected parties. - Four-tier risk classification: Classifies actions as read-only, reversible writes, external side effects, or high-risk, with boundary and impact notes for each. - Prioritized build plan: Orders action boundaries by consequence severity and frequency, ending with a single recommendation for the first judge to instrument. - Use Case: Before connecting a support agent to email and a CRM, run the audit to discover that sending customer emails is a Tier 3 boundary needing a judge, while internal ticket labeling can ship without one. ## Quick Start Ask the assistant to run an action surface audit on your agent, describing what the agent does, which tools and APIs it can call, and what side effects it can produce.

Frequently Asked Questions about action-surface-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit the actions an AI agent can take?

Run an action surface audit that inventories every action the agent can take or trigger, then classifies each by risk tier. The audit is driven by a structured interview about the agent's tools, side effects, affected parties, and existing review processes.

How to decide where to add judge layers in an agent system?

Classify each agent action into tiers from read-only to high-risk, then prioritize boundaries by consequence severity and frequency. The first judge should cover the boundary with the highest combination of risk and volume, typically external side effects like sending messages or updating shared records.

When should I run an action surface audit?

Run it before building any judge infrastructure for a new agent. It is also useful when expanding an existing agent's capabilities, connecting new tools, or adding multi-agent handoffs, since each handoff is its own boundary that may need judgment.

What are the risk tiers for classifying agent actions?

Actions are classified into four tiers: Tier 1 read-only with no side effects, Tier 2 reversible internal writes, Tier 3 external side effects affecting other people or systems, and Tier 4 high-risk actions like spending money, deleting data, or changing permissions.

Can read-only agent actions skip judgment entirely?

Tier 1 read-only actions generally do not need a judge, but Tier 3 and Tier 4 actions should never skip judgment. The audit treats lightweight judgment as still judgment and flags ambiguous classifications rather than assuming actions are safe.