/commerce-app-review

name: commerce-app-review
description: Use when validating an App Builder app before submitting to Adobe Exchange, or when the user mentions Adobe Commerce app compliance, extension review, marketplace submission, or Adobe Exchange listing. Checks security requirements, project structure, documentation completeness, and dependency health; reports MUST-have blockers and NICE-to-have recommendations and walks through each finding interactively.
license: Apache-2.0

Self-review an App Builder app

Reviews a local app directory against Adobe's Commerce submission guidelines and walks through each finding interactively — MUST-have blockers first, then NICE-to-have recommendations.

Inputs

• `APP_PATH` *(optional)* — path to the app root. Defaults to the current working directory.
• `APP_TYPE` *(required)* — `downloadable` or `non-downloadable`. A downloadable app allows merchants to download the source package; a non-downloadable app is installed directly from Adobe Exchange with one click.

Procedure

1. Validate the path and app type

If `APP_PATH` is not provided, use the current working directory. Confirm it exists and is a directory. If not, stop and report:

> Path not found. Please provide the path to the root of your app codebase.

If `APP_TYPE` is not provided, ask:

> **Is this app downloadable or non-downloadable?** > - **Downloadable** — merchants download the source package and deploy it themselves > - **Non-downloadable** — merchants install directly from Adobe Exchange with one click

Do not proceed until both are confirmed.

Check whether `aio` is installed (e.g. `command -v aio`). This is a presence check only — do not attempt to authenticate at this stage. If `aio` is not found, note it once:

> Note: `aio` isn't installed. Walkthrough enrichment (Step 8) will use fallback knowledge > unless `aio` is installed and authenticated before then.

Continue either way.

2. Load local references

Read `references/finding.md` and all files under `references/exceptions/` (paths relative to this skill file).

Load pattern files conditionally:

• references/patterns/cors-storefront-actions.md — always
• references/patterns/accs-rest-api-dependency.md — always
• references/patterns/aio-commerce-sdk.md — always
• references/patterns/admin-ui-sdk.md — only if commerce/backend-ui/1 is in app.config.yaml or ext.config.yaml, or @adobe/uix-guest/@adobe/uix-core in package.json

Pattern files take precedence over fetched guidelines. Exception files suppress findings from both.

If any file is not found, skip and continue.

3. Fetch the guidelines

Fetch both pages using `curl`. Use raw GitHub URLs — the rendered developer.adobe.com pages are not reliably accessible:

• **Submission guidelines**: `https://raw.githubusercontent.com/AdobeDocs/commerce-extensibility/refs/heads/main/src/pages/app-development/app-submission-guidelines.md`
• **Admin UI SDK checklist**: `https://raw.githubusercontent.com/AdobeDocs/commerce-extensibility/refs/heads/main/src/pages/admin-ui-sdk/app-review-checklist.md` — only if `commerce/backend-ui/1` is in `app.config.yaml` or `ext.config.yaml`, or `@adobe/uix-guest`/`@adobe/uix-core` in `package.json`

If a page is unreachable, note which one failed, proceed with the other, and warn the user that coverage is partial.

4. Read the app

Read these files in order:

1. `app.config.yaml` — extension points, actions, inputs, annotations, productDependencies 2. `package.json` — name, description, author, version, dependencies, scripts 3. `env.dist` / `env.example` / any `env.*` at the root — documented env vars 4. `README.md` — installation instructions, events, API requirements 5. `deploy.yaml` — app ID, APIs, workspaces 6. `install.yaml` — extension points (if Admin UI SDK detected) 7. Every `*.config.yaml` and `ext.config.yaml` under `src/` and `actions/` 8. Every `index.js` under `actions/` 9. `web-src/src/` — UI code, innerHTML, routing 10. `extension-manifest.json` — if Admin UI SDK detected

If a file does not exist, note it and continue.

5. Review

Build a complete list of checks from the pattern files and fetched guidelines. Then work through every item silently, one by one. Do not skip any item.

**Exclude the following entirely — do not check:**

• `npm audit`, `npx npm-check`, or any check requiring running npm
• Exchange listing URL, repository visibility, screenshots in Exchange listing
• Any check requiring a live Exchange listing, deployed environment, or external URL

For each item:

• Check it against the files read in Step 4
• If confirmed → record as FINDING with severity, file, and line number
• If an exception in `references/exceptions/` applies → suppress it
• If not applicable to `APP_TYPE` → skip it

**Before recording any FINDING, verify it in the actual files. If you cannot point to a specific file and line number, do not flag it.**

**Before flagging a missing package — verify it is directly imported in source files, not just a transitive dependency.**

After working through all items, collect all FINDINGs and assign codes: `MUST-<n>` and `NICE-<n>`. Merge closely related findings before assigning codes.

For each finding track:

• `SEVERITY` — `MUST` or `NICE`
• `DESCRIPTION` — one sentence, specific and actionable
• `FILE_PATH` — **absolute** path to the relevant file; empty for general issues. Render as a markdown link: `[relative/path](file:///absolute/path)`
• `LINE_NUMBER` — specific line; 0 for general issues
• `CATEGORY` — one or more of: `security` · `documentation` · `code` · `dependencies` · `other`

6. Present the raw findings list

Print a concise findings list — **no enrichment yet**. Format:

Found N MUST-have issue(s) and M NICE-to-have recommendation(s).

**MUST — blockers**
- MUST-1: <one-line description> (`<FILE_PATH>`, line <LINE_NUMBER>)
- MUST-2: …

**NICE — recommendations**
- NICE-1: <one-line description> (`<FILE_PATH>`, line <LINE_NUMBER>)
- NICE-2: …

Omit a group heading if