review-044295 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-044295 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Two modes. First turn: print the audit and stop. On a user follow-up ("fix the top one," "walk these," "do A," "pay some down"), apply the rubric below.
python3 ${CLAUDE_PLUGIN_ROOT}/skills/review/scripts/review.pyOptional: --top N to surface more than the default 3 candidates.
Re-emit the helper's stdout verbatim in a fenced code block. Claude Code collapses long bash outputs behind a +N lines, ctrl+o to expand placeholder — if you don't print it yourself, the user never sees it. Copy exactly: no preamble, no summary, no "want me to fix the top one?" The fenced block preserves column alignment.
Then stop. The user picks the next move.
Work through requested entries one at a time. Confirm before each fix. Never auto-batch. Never auto-commit.
For each entry, read the registry file, the hotspot, and adjacent tests. Apply this rubric:
created: and age >90d → propose deferring. ~20% of files generate ~80% of debt-related rework; don't pay down vanity refactors.payoff_trigger or body — don't commit code you can't explain.ai_authored: true → invoke /code-review on the diff before suggesting commit. Fresh-context review catches what the writer's motivated reasoning misses.drop A, and commits.Aim for 3–10 entries per session — continuous paydown outperforms stop-the-world batches. If the user says "do them all," push back once: unsupervised AI cleanup measurably increases duplicate blocks and short-term churn. If they insist, still one-at-a-time with diffs surfaced.
The frontmatter uses a research taxonomy (quadrant, category) for ranking and grounding — it is not user-facing vocabulary. When you talk about an entry, describe it in plain words; never say "prudent-inadvertent", "reckless-deliberate", "code_rot", etc. to the user. Use the entry's body and a plain phrase (e.g. "a planned tradeoff", "a shortcut you knew about", "came up later") instead. The review.py output is already translated — match its tone.
review.py.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.