review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Two-axis review of the diff between HEAD and a fixed point the user supplies:
Both axes run as parallel sub-agents so they don't pollute each other's context, then this skill aggregates their findings.
The issue tracker should have been provided to you — run /setup-matt-pocock-skills if docs/agents/issue-tracker.md is missing.
Whatever the user said is the fixed point — a commit SHA, branch name, tag, main, HEAD~5, etc. Don't be opinionated; pass it through. If they didn't specify one, ask: "Review against what — a branch, a commit, or main?" Don't proceed until you have it.
Capture the diff command once: git diff <fixed-point>...HEAD (three-dot, so the comparison is against the merge-base). Also note the list of commits via git log <fixed-point>..HEAD --oneline.
Look for the originating spec, in this order:
#123, Closes #45, GitLab !67, etc.) — fetch via the workflow in docs/agents/issue-tracker.md.docs/, specs/, or .scratch/ matching the branch name or feature.Anything in the repo that documents how code should be written. Common locations:
CLAUDE.md, AGENTS.mdCONTRIBUTING.mdCONTEXT.md, CONTEXT-MAP.md, per-context CONTEXT.md filesdocs/adr/ (architectural decisions are standards).editorconfig, eslint.config.*, biome.json, prettier.config.*, tsconfig.json (machine-enforced standards — note them but don't re-check what tooling already checks)STYLE.md, STANDARDS.md, STYLEGUIDE.md, or similar at the repo root or under docs/Collect the list of files. The Standards sub-agent will read them.
Send a single message with two Agent tool calls. Use the general-purpose subagent for both.
Standards sub-agent prompt — include:
Spec sub-agent prompt — include:
If the spec is missing, skip the Spec sub-agent and note this in the final report.
Present the two reports under ## Standards and ## Spec headings, verbatim or lightly cleaned. Do not merge or rerank findings — the two axes are deliberately separate so the user can see them independently.
End with a one-line summary: total findings per axis, and the worst single issue (if any) flagged.
A change can pass one axis and fail the other:
Reporting them separately stops one axis from masking the other.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.