Commerce App Review

Self-review an App Builder app

Reviews a local app directory against Adobe's Commerce submission guidelines and walks through each finding interactively — MUST-have blockers first, then NICE-to-have recommendations.

Inputs

• APP_PATH (optional) — path to the app root. Defaults to the current working directory.
• APP_TYPE (required) — downloadable or non-downloadable. A downloadable app allows merchants to download the source package; a non-downloadable app is installed directly from Adobe Exchange with one click.

Procedure

1. Validate the path and app type

If APP_PATH is not provided, use the current working directory. Confirm it exists and is a directory. If not, stop and report:

Path not found. Please provide the path to the root of your app codebase.

If APP_TYPE is not provided, ask:

Is this app downloadable or non-downloadable?

• Downloadable — merchants download the source package and deploy it themselves
• Non-downloadable — merchants install directly from Adobe Exchange with one click

Do not proceed until both are confirmed.

Check whether aio is installed (e.g. command -v aio). This is a presence check only — do not attempt to authenticate at this stage. If aio is not found, note it once:

Note: aio isn't installed. Walkthrough enrichment (Step 8) will use fallback knowledge unless aio is installed and authenticated before then.

Continue either way.

2. Load local references

Read references/finding.md and all files under references/exceptions/ (paths relative to this skill file).

Load pattern files conditionally:

• references/patterns/cors-storefront-actions.md — always
• references/patterns/accs-rest-api-dependency.md — always
• references/patterns/aio-commerce-sdk.md — always
• references/patterns/admin-ui-sdk.md — only if commerce/backend-ui/1 is in app.config.yaml or ext.config.yaml, or @adobe/uix-guest/@adobe/uix-core in package.json

Pattern files take precedence over fetched guidelines. Exception files suppress findings from both.

If any file is not found, skip and continue.

3. Fetch the guidelines

Fetch both pages using curl. Use raw GitHub URLs — the rendered developer.adobe.com pages are not reliably accessible:

• Submission guidelines: https://raw.githubusercontent.com/AdobeDocs/commerce-extensibility/refs/heads/main/src/pages/app-development/app-submission-guidelines.md
• Admin UI SDK checklist: https://raw.githubusercontent.com/AdobeDocs/commerce-extensibility/refs/heads/main/src/pages/admin-ui-sdk/app-review-checklist.md — only if commerce/backend-ui/1 is in app.config.yaml or ext.config.yaml, or @adobe/uix-guest/@adobe/uix-core in package.json

If a page is unreachable, note which one failed, proceed with the other, and warn the user that coverage is partial.

4. Read the app

Read these files in order:

1. app.config.yaml — extension points, actions, inputs, annotations, productDependencies
2. package.json — name, description, author, version, dependencies, scripts
3. env.dist / env.example / any env.* at the root — documented env vars
4. README.md — installation instructions, events, API requirements
5. deploy.yaml — app ID, APIs, workspaces
6. install.yaml — extension points (if Admin UI SDK detected)
7. Every *.config.yaml and ext.config.yaml under src/ and actions/
8. Every index.js under actions/
9. web-src/src/ — UI code, innerHTML, routing
10. extension-manifest.json — if Admin UI SDK detected

If a file does not exist, note it and continue.

5. Review

Build a complete list of checks from the pattern files and fetched guidelines. Then work through every item silently, one by one. Do not skip any item.

Exclude the following entirely — do not check:

• npm audit, npx npm-check, or any check requiring running npm
• Exchange listing URL, repository visibility, screenshots in Exchange listing
• Any check requiring a live Exchange listing, deployed environment, or external URL

For each item:

• Check it against the files read in Step 4
• If confirmed → record as FINDING with severity, file, and line number
• If an exception in references/exceptions/ applies → suppress it
• If not applicable to APP_TYPE → skip it

Before recording any FINDING, verify it in the actual files. If you cannot point to a specific file and line number, do not flag it.

Before flagging a missing package — verify it is directly imported in source files, not just a transitive dependency.

After working through all items, collect all FINDINGs and assign codes: MUST-<n> and NICE-<n>. Merge closely related findings before assigning codes.

For each finding track:

• SEVERITY — MUST or NICE
• DESCRIPTION — one sentence, specific and actionable
• FILE_PATH — absolute path to the relevant file; empty for general issues. Render as a markdown link: [relative/path](file:///absolute/path)
• LINE_NUMBER — specific line; 0 for general issues
• CATEGORY — one or more of: security · documentation · code · dependencies · other