In JSF 1.2 you can specify onclick events.
Also, other libraries such as MyFaces or IceFaces implement the "onclick" handler.
What you'd need to do then is simply:
<h:commandLink action="#{bean.action}" onclick="if(confirm('Are you sure?')) return false;" />
Note: you can't just do return confirm(...)
as this will block the rest of the JavaScript in the onClick event from happening, which would effectively stop your action from happening no matter what the user returned!