Install
$ agentstack add skill-orcaqubits-agentic-commerce-skills-plugins-acp-capability-negotiation ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
ACP Capability Negotiation
Before writing code
Fetch live docs:
- Web-search
site:github.com agentic-commerce-protocol rfcs capability_negotiationfor the capability negotiation RFC - Fetch
https://developers.openai.com/commerce/specs/checkout/for how capabilities appear in checkout requests/responses - Web-search
site:github.com agentic-commerce-protocol spec json-schema capabilitiesfor the capabilities JSON schema
Conceptual Architecture
What Capability Negotiation Does
ACP agents and merchants may support different features. Capability negotiation allows them to dynamically discover what they both support, so the session uses only mutually available features.
How It Works
- Agent sends capabilities — In the
createrequest, the agent includes acapabilitiesobject listing what it supports - Merchant responds with capabilities — The merchant intersects with its own capabilities and returns what's active for this session
- Intersection governs the session — Only mutually supported features are used
Capabilities Object Structure
The capabilities object contains:
capabilities— Major features (checkout, orders, etc.)extensions[]— Optional add-ons (discount, intent traces, affiliate attribution)payment_handlers[]— Supported payment methodsinterventions— Structured object with sub-fields:supported,required,enforcement,display_context,redirect_context,max_redirects,max_interaction_depth
Extension Pruning
Extensions declare a parent capability via extends. If the parent capability is not in the negotiated intersection, the extension is automatically pruned — no extra logic needed.
Interventions
Interventions are actions that require human involvement. They are represented as a structured object (not a flat array) with sub-fields including supported, required, enforcement, display_context, redirect_context, max_redirects, and max_interaction_depth.
Intervention types include:
- 3D Secure — Card authentication challenge
- Biometric — Fingerprint/face verification
- Address Verification — Address confirmation flow
- Other authentication or verification flows
The agent advertises which interventions it can handle. If the merchant requires an intervention the agent can't handle, the checkout may not proceed.
Versioning in Negotiation
- Each capability has its own version
- Extensions are versioned independently (
discount@2026-01-27) - Payment handlers have their own version
- Version mismatches are resolved by intersection (both must support a compatible version)
Use Cases
- Merchants that support different feature sets for different plans
- Agents that gradually adopt new protocol features
- Graceful degradation when features aren't mutually supported
- Multi-merchant agents that adapt per-merchant
Best Practices
- Always include capabilities in the create request
- Advertise all capabilities you support — don't under-report
- Handle the case where the merchant supports fewer features than expected
- Log negotiated capabilities for debugging
- Test with minimal capability sets to ensure graceful degradation
- Update advertised capabilities as you adopt new spec features
Fetch the capability negotiation RFC for the exact capabilities object schema, extension pruning rules, and negotiation semantics before implementing.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: OrcaQubits
- Source: OrcaQubits/agentic-commerce-skills-plugins
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.