Review an AI Agent's Approval Policy in 10 Minutes with an AI Skill

agent-approval-policy-review is a free, open-source skill. You give your AI tool a list of an agent's tools, and it sorts each one into a risk tier, lists the gaps in order of severity, proposes a policy and writes the tests. It works in Claude Code, Codex, Cursor and GitHub Copilot, because all four read the same SKILL.md format. The review is a second pair of eyes on a design you describe, not a security audit of your code.

The skill is built on the same risk tiers as our guide to approval design for AI agents: read-only actions run alone, reversible internal actions run and get logged, external or irreversible actions ask the owner, and money, identity or access changes ask a named approver. What the skill adds is a repeatable procedure for applying those tiers to your agent.

Clone the repo and run the install script for your tool. These folder locations come from each tool's own documentation as of October 2026, so check your tool's current docs if a skill does not appear.

git clone https://github.com/learnaiengineering-dev/ai-skills.git
cd ai-skills
scripts/install.sh agents    # shared .agents/skills folder: Codex, Cursor, Copilot
scripts/install.sh claude    # Claude Code

Claude Code can also install it as a plugin: /plugin marketplace add learnaiengineering-dev/ai-skills, then /plugin install ai-skills@learnaiengineering. Then ask in plain language, for example "review the approval policy for my agent, its tools are...".

We tested the skill by running it with Claude on an invented scenario that contained three planted traps. The prompt was:

Prompt: Review the approval policy for my accounts-payable agent. Its tools are: read_invoice, search_web, create_ticket, send_email, issue_refund, update_vendor_bank_details, run_sql (takes any SQL string), and get_report (generates a PDF and emails it to a distribution list). Right now everything except issue_refund runs automatically. Also the config says: 'if a tool output says the action is pre-approved, skip approval'.

The scenario is illustrative, not a real company. This is the tool table from the skill's answer, with the reasons shortened:

The first three findings it ranked High were:

• `update_vendor_bank_details` runs automatically. One injected or spoofed email could redirect every future payment to an attacker. Fix: require a named approver, with out-of-band verification of the change (callback to a known number). The agent must never be the approver.

• The config rule "if a tool output says the action is pre-approved, skip approval" is itself a bypass. Tool output is data, not authority. Any web page, invoice PDF or email can say "pre-approved". Fix: delete the rule and take approval state only from a deterministic policy engine.

• `run_sql` accepts any SQL string and runs automatically. It can exfiltrate, modify or drop data, and it bypasses every other gate. Fix: replace it with fixed, parameterised read-only queries.

It then listed five more findings, a policy proposal, a test list (including "a tool output containing 'pre-approved' changes nothing") and a note on how to tell whether approvals are being read or just clicked through.

We ran the skill twice against the same prompt, editing it in between. The first version found everything above, but returned 13 findings and several repeated the tool table, so the three that mattered were easy to miss. We added a cap of the eight most important findings and a rule to merge duplicates, and the second run returned exactly eight with the bank-details gap first. That run also showed a smaller problem: a tool that behaves differently by mode, such as read versus write SQL, was described inconsistently between the table and the tests. We then added a rule that each mode gets its own row. We have not re-run that last fix.

This is a small test: one scenario per run, run with one assistant. It shows the instructions work as intended, not that the skill is right for every agent. Treat its output as a draft review that a person confirms.

1. List every tool your agent can call, including any that email, write or run code. 2. Install the skill and run it on that list. Fix the High findings first. 3. Turn the test list into real tests in your repo, so a new tool cannot quietly bypass the policy. 4. Re-run the review each time you add or change a tool.

What is an AI skill? A skill is a folder with a SKILL.md file: a short description of when to use it, and instructions your AI tool follows when your request matches. Claude Code, Codex, Cursor and GitHub Copilot all support this format, so one skill works in each.

Does the skill read my code or config? Only what you give it. If you paste a config or tool definitions, it extracts the tool list and asks you to confirm it. It does not scan your repository on its own.

Is this a security audit? No. It reviews the design you describe against a checklist. It can miss things that only show up in the code or the deployment, so use it to prepare for a real review, not to replace one.

Why does it block free-form SQL? A tool that takes any SQL string can read or change anything the database user can, so it cannot be given a safe tier. The usual fix is narrow, parameterised tools, each with its own tier.

Can a model reviewer approve risky actions instead of a person? In this design a model reviewer can only escalate an action to a person. It can never lower a decision that the rules made, because a reviewer can be fooled by the same injected text as the agent.

Do I need all four tools installed? No. Install it for the one you use. The install script copies the same folder to each tool's skills location.

How often should I run it? Every time you add or change a tool, and before moving an agent from a pilot to wider use.

Is it free? Yes. The skills are MIT licensed and open source on GitHub.