simplify — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited simplify (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Review all changed files for reuse, quality, and efficiency. Fix any issues found.
Determine what changed and what tooling is available before any analysis.
Run scripts/build-review-packet.py (shipped in this skill's scripts/) to resolve scope and pre-bake one packet — diff plus changed-file list — that the three review agents read by path instead of each re-running git. It auto-detects staged vs. branch vs. worktree and prints packet_path in its JSON. Fall back to git diff (or git diff HEAD) for a manual scope. If there are no git changes, review the most recently modified files that the user mentioned or that you edited earlier in this conversation.
If the code-review-graph MCP plugin is available, probe and ensure freshness:
build_or_update_graph_tool(base=<base>) to run an incremental update.list_graph_stats_tool() to verify the graph has nodes and check last_updated.Do not retry.
When the graph is available, follow references/code-review-graph-integration.md for enhanced analysis at each subsequent step.
Always (git-based):
When graph is available (see references/code-review-graph-integration.md Phase 1):
detect_changes_tool(base=<base>) for risk-scored, priority-ordered triage.get_review_context_tool(base=<base>) for token-efficient structural context.get_affected_flows_tool (2+ files) or get_architecture_overview_tool (3+ directories).Pass all available context — diff, and graph triage data if available — to each agent in Phase 2.
Use the Agent tool to launch all three agents concurrently in a single message. Give each agent the packet path from Phase 0 as its starting point (plus graph context from Phase 1 if available): the packet has the diff and changed files, but it is a floor, not a ceiling — agents still read surrounding code, callers, and existing utilities the diff does not show (Agent 1's reuse search is inherently off-diff). When graph data includes risk scores, instruct agents to review highest-risk items first.
For each change:
Look for similar patterns elsewhere in the codebase — common locations are utility directories, shared modules, and files adjacent to the changed ones. When graph is available: use semantic_search_nodes_tool and query_graph_tool("callers_of") per the integration reference.
Suggest the existing function to use instead.
When graph is available: use refactor_tool(mode="dead_code") per the integration reference.
Before recommending deletion of code that looks redundant or dead, apply Chesterton's Fence: check git blame, nearby comments, and tests to understand _why_ it was written. If the original reason still applies (platform quirk, perf workaround, edge case), keep it. "I don't see why this is here" is not the same as "this isn't needed."
Review the same changes for hacky patterns:
When graph is available: use get_impact_radius_tool per the integration reference.
When graph is available: use find_large_functions_tool per the integration reference.
Grep for callers in the codebase and verify they still match. When graph is available: use query_graph_tool("callers_of") and query_graph_tool("inheritors_of") per the integration reference.
Search for test files that exercise the changed functions. When graph is available: use query_graph_tool("tests_for") per the integration reference.
data, result, tmp, val, item) where a content-bearing name fits; non-standard abbreviations (usr, cfg, evt) where full words read better; misleading names (a get* that mutates, an is* that returns a non-boolean).Match the codebase's existing naming conventions rather than imposing new ones.
Review the same changes for efficiency:
When graph is available: use query_graph_tool("callees_of") per the integration reference.
When graph is available: cross-reference with affected flows from Phase 1.
Also: if a wrapper function takes an updater/reducer callback, verify it honors same-reference returns (or whatever the "no change" signal is) — otherwise callers' early-return no-ops are silently defeated
When graph is available: use query_graph_tool("importers_of") per the integration reference.
Wait for all three agents to complete. Aggregate their findings and fix each issue directly. If a finding is a false positive or not worth addressing, note it and move on — do not argue with the finding, just skip it.
Preserve behavior exactly. Fixes must keep inputs, outputs, side effects, ordering, and error paths identical. If a fix requires editing existing tests to pass, that's a signal you changed behavior — revert and reconsider rather than updating the tests to match.
Stay in scope. Fix what the agents flagged in the changed code; don't drive-by refactor unrelated code. If a fix's blast radius grows beyond the original diff, surface it to the user instead of silently expanding the change.
When done, briefly summarize what was fixed (or confirm the code was already clean).
references/code-review-graph-integration.md — tool dispatch playbook for code-review-graph MCP plugin (availability gate, required + optional tools per phase, tool quick reference).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.