open-code-review-delegate-cef991 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited open-code-review-delegate-cef991 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A skill for performing AI code review where OCR provides deterministic engineering (file filtering, rule resolution) and the host agent performs the actual review using its own intelligence and tools.
ocr delegate preview --format json [--from <ref> --to <ref>] [--commit <hash>] [--exclude <patterns>]This outputs:
Common invocations:
| Scenario | Command |
|---|---|
| Workspace changes | ocr delegate preview |
| Branch comparison | ocr delegate preview --from main --to feature |
| Single commit | ocr delegate preview -c abc123 |
ocr delegate rule --format json <path1> <path2> ...Pass the reviewable file paths from Step 1. Output is grouped by rule content — files sharing the same rule appear under one group, avoiding repetition.
Choose the diff command using the mode and refs from Step 1. Use git --no-pager for every Git call during the review.
The diff commands disable external diff programs, text conversion, and color to produce plain patches.
Range mode (merge_base provided in preview output):
git --no-pager diff --no-ext-diff --no-textconv --no-color <merge_base>..<to> -- "<path>"Commit mode:
git --no-pager show --no-ext-diff --no-textconv --no-color <commit> -- "<path>"Workspace mode:
# Tracked files
git --no-pager diff --no-ext-diff --no-textconv --no-color HEAD -- "<path>"
# New untracked files — read directly (entire file is new code)
cat "<path>"To read context:
git --no-pager log --no-color --oneline -- "<path>"
git --no-pager blame --no-textconv -- "<path>"
git --no-pager show --no-ext-diff --no-textconv --no-color "<ref>:<path>"For large diffs, add --output="<absolute-diff-file>" to the command for the selected mode. Choose a unique absolute path outside the repository and create its parent directory. Use the same path in file-reading tool calls:
git --no-pager diff --no-ext-diff --no-textconv --no-color --output="<absolute-diff-file>" <merge_base>..<to> -- "<path>"After Git exits with code 0, read and review the entire file in chunks, then remove it. If Git fails or times out, retry or record skipped with the error. Check unexpectedly empty output against a fresh preview.
Create a checklist containing every reviewable_files entry. For each reviewable file:
Use (path, status) as the checklist identity. Workspace mode can report the same path twice when a staged deletion is followed by an untracked recreation.
reviewed, or skipped with a concrete reasonFor large changes, review in bounded batches grouped by shared rules and diff size. Do not stop after finding the first high-severity issue.
Each comment must follow this structure:
| Field | Type | Required | Description |
|---|---|---|---|
| path | string | yes | Relative file path |
| content | string | yes | Review comment describing the issue |
| start_line | integer | no | Start line in the new file |
| end_line | integer | no | End line in the new file |
| category | enum | no | bug, security, performance, maintainability, test, style, documentation, other |
| severity | enum | no | critical, high, medium, low |
Before reporting, verify that every previewed file is accounted for. Include total_files, reviewed_files, skipped_files, and coverage_rate in the summary. A skipped file must include its reason.
Group findings by severity:
Discard likely false positives silently.
If the user requested "review and fix":
| Command | Purpose |
|---|---|
ocr delegate preview | Which files to review + mode/ref metadata |
ocr delegate rule <path...> | Review rules grouped by content |
| Flag | Description | |
|---|---|---|
--from <ref> | Source ref for range mode | |
--to <ref> | Target ref for range mode | |
-c, --commit <hash> | Single commit mode | |
--repo <path> | Repository root (default: cwd) | |
--rule <path> | Custom rule.json path | |
--exclude <patterns> | Comma-separated exclude patterns | |
-b, --background <text> | Business context | |
-B, --background-file <path> | Business context from Markdown file (takes precedence over -b) | |
| `-f, --format <text\ | json>` | Output format; use json for agent integrations |
ocr delegate operates on the Git repo at the current directory. Use --repo /path to override.preview includes untracked files. For these, read the file directly instead of using git diff.--background to preview when you have requirement context; it appears in the output for your reference during review.reviewable_files entry must end as reviewed or explicitly skipped; do not silently omit files.--background-file has two independent limits. The raw file must not exceed 1 MiB, and the sanitized content must not exceed 8000 characters. Either condition aborts the command. When the command reports either limit:
constraints, acceptance criteria, and other review-critical details.
argument (for example, use a quoted/escaped argument produced by the host shell, or write it to a new size-bounded file and pass that file). Do not place untrusted summary text directly in a double-quoted shell template; $(), backticks, quotes, and variable references can still be evaluated. Omit the original --background-file so the CLI does not reload the same oversized file and fail again.
read the original material directly during the review.
The --format flag is available in ocr v1.9.0 and later. The Skill and the installed CLI can be updated independently. If a requested preview or rule command with --format json fails specifically with unknown flag: --format, rerun it without the flag and use text output for the rest of the delegation run. Preserve the explicit mode, ref, file, and rule information from that output; do not parse text output as JSON or invent missing schema fields. Do not retry without the flag for any other error; report it and stop the affected workflow.
The host-agent Skill may consume the equivalent text output to complete its review checklist. Programmatic integrations that require schema_version or other JSON fields must require a JSON-capable CLI instead: verify with ocr --version and upgrade when necessary:
npm install -g @alibaba-group/open-code-review~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.