addlightness-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited addlightness-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Measure code weight and surface removable "fat" candidates. This is the diagnostic half of addlightness: it reports, it never edits. For actual trimming use /addlightness; for performance numbers use /addlightness-bench.
This skill NEVER modifies files. It reads, measures, and reports. Period.
Edit, no Write, no in-place fixes, no "I went ahead and removed it"./addlightness <file...>(which spawns the edit-capable code-trimmer agent behind an equivalence gate).
Repeat this contract back to the user if they ask you to "just fix it" here -- review reports, /addlightness edits.
For each target file, get its weight metrics from the zero-dependency engine. Two equivalent paths -- prefer the agent for multi-file work, the direct call for a single quick read:
spawn the weight-analyst agent. It is read-only by contract (its prompt forbids mutating Bash commands; it has no Edit/Write) and returns the metrics table plus a ranked fat list and a KEEP list. The agent analyzes one file per invocation — spawn one weight-analyst invocation per file and aggregate the JSON yourself.
node "${CLAUDE_PLUGIN_ROOT}/lib/weigh.js" path/to/file.js --jsonThe engine emits one JSON object per file with the scalar weight plus the raw components (loc, cyclomatic, imports, functions, nesting, tokens), an approx boolean (true = JS/TS regex approximation, false = Python ast-accurate), and the weight_formula string. Parse the JSON line; do not screen-scrape prose. The approx flag is the authoritative accuracy signal — read it rather than guessing from the language.
weight = 1.0*loc + 2.0*cyclomatic + 1.5*imports + 1.0*functions + 3.0*nestingJS/TS metrics are regex-on-stripped-source approximations (comments, strings, and templates are stripped first). Python metrics come from the stdlib ast module and are accurate. Say which is which when you report.
Aggregate across all targets into one report. Glob the user's pattern (e.g. src/**/*.js) yourself, then weigh each match.
For every candidate, report a row -- never an edit:
| field | meaning |
|---|---|
| category | one of the categories below |
| location | file:line (or file:start-end) |
| current | the exact code as it stands |
| proposed | what a trim would look like (for the human, not applied) |
| why-safe | the specific reason removing it preserves behavior |
| risk | low / medium / high -- residual doubt after why-safe |
Categories:
adds no abstraction value; inlining removes a hop. Confirm the single call site with Grep before flagging.
type system already proves can never fire. Only flag when you can show the proof (the value is produced two lines up, the type is non-null by construction, etc.). If the value crosses a trust boundary, it goes on the KEEP list instead -- see below.
pulling fields never used.
Boolean(x) in a boolean context, String(x) in atemplate, !!x where truthiness already suffices, +x on a known number.
if (false), a return followed by code, an arm shadowed by an earlier one.
async on a function that never awaits and whosecaller does not rely on the Promise wrapping. (Flag cautiously -- check call sites; removing async changes the return type and turns sync throws into thrown errors instead of rejected Promises.)
// increment iabove i++). Why-comments are NOT fat -- never flag those.
shorter one is clearer. Never flag public/exported names.
with Grep across the file (and re-exports) before flagging.
Produce three sections, in this order:
functions | nesting | tokens`, with a total/average row. Note JS=approx, Python=ast-accurate.
(high-confidence, high-payoff first). Group by file.
check, validation, guard, or coercion that looks like fat but must stay, with the reason it stays. The headline reason is the trust boundary: any value that is externally controlled -- public API parameters, file/socket IO, parsed/network/env/user/CLI data -- keeps its validation even if current tests pass without it. A passing test suite with well-formed inputs is NOT proof the check is dead; it is the #1 way validation gets wrongly stripped.
A review with an empty KEEP list on real code is suspect -- you probably mislabeled a boundary check as fat.
The scalar is a relative before/after metric, not an industry standard. Lower = lighter. Read the ratios, not raw size:
(fat) or explain why (keep).
candidate for naming or extraction (report, don't apply).
decisions; suggests padding, boilerplate, or copy-paste.
ceremony/padding rather than essential logic.
strongest structural-fat signal (early returns / guard clauses often flatten it).
Raw LOC alone is a weak signal -- a 200-line file of essential branching can be leaner than a 60-line file of wrappers. Always pair LOC with the complexity and nesting ratios.
approximations on stripped source; say "approximate". Python via ast may be called accurate.
go on the KEEP list, with the boundary named.
are candidates.
sites / references via Grep first.
change-magnitude and structural signals. The user's own test suite is the only true equivalence proof, and that proof belongs to /addlightness, not here.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.