address-code-review-comments — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited address-code-review-comments (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A reviewer (a human, or a tool like CodeRabbit) left a set of comments on a pull request — each a claimed bug, omission, style violation, or risk in the diff. Your job is to judge each comment on its merits against the actual code in the PR, fix the ones that are genuinely valid by editing the PR's own source and tests, and then report your decisions in chat.
Two things make this skill what it is, and you must hold both:
If the PR or the comments are missing, ask — do not invent comments or guess the PR.
The whole point of this step is to get onto the exact code the reviewer saw, locally, so the rest of the work reads files straight from disk instead of round-tripping through the GitHub API.
<pr> is the number or URL from the invocation — with a bare number, run this from inside the target repo so gh resolves it): gh pr view <pr> --json number,title,headRefName,headRefOid,url,closingIssuesReferencesNote the closingIssuesReferences — the issue this PR is meant to close. It carries the real intent and acceptance criteria, which is often what decides whether a comment is valid (a "fix" that fights the issue's goal is not a fix). Read that issue when a comment's validity turns on original intent; don't read it just to read it.
git worktree listPick the worktree whose checked-out branch equals the PR's headRefName.
EnterWorktree tool, passing that worktree's path (path: <worktree dir>).headRefOid: git rev-parse HEADIt must equal headRefOid from step 1. Once it matches, trust the working tree: every file the PR changed is present locally, so read and edit it directly with Read/Edit — do not pull diffs or file contents through gh/the git API. That round-tripping is the waste this step exists to avoid.
If something doesn't line up, stop and ask instead of guessing:
headRefOid (worktree is behind/ahead of the PR) → report the mismatch and ask how to proceed (e.g. pull). Working on stale code would invalidate every judgment below.For comments pasted as text, take them as-is. For links to specific review comments, fetch the body via the GitHub API so you act on the reviewer's actual words rather than the URL — the numeric id in a comment link's anchor is the comment id. For an inline review comment:
gh api repos/{owner}/{repo}/pulls/comments/<ID> --jq '{path, line, body}'gh fills {owner}/{repo} from the repo you're in (the PR's worktree, after step 0). Other link kinds resolve through their matching endpoint; if a link won't resolve, ask rather than guess what it said.
Extract the concrete claim from each: the file/symbol/line it names, what it asserts is wrong, and the change it recommends. Treat each as a hypothesis to confirm.
Confirm or refute each comment against the real code and the repo's own conventions:
rg search. A 30-second experiment beats a confident guess (e.g. proving two fixtures are not interchangeable by actually constructing both).Edit the code on the PR's branch to close every valid (or partially-valid) comment:
Don't hand back edits you haven't checked. For the files you touched, run the project's own lint/format and the relevant tests, using its standard tooling and environment (its virtualenv, task runner, or scripts) rather than global interpreters. If a fix breaks something, fix it or reconsider whether the comment was really valid. Report honestly if something still fails.
Reply in the chat (no file is written). Keep the two halves deliberately asymmetric — the diff already shows what you changed, but a rejection leaves no trace, so it needs your full reasoning:
Key each bullet to the comment (its file:line or a short quote) so the mapping is unambiguous. If every comment was valid, say so under Not closed (- None — every comment was valid and addressed.); if none were, say so under Closed.
End by stating that you have not committed or pushed — the edits sit in the worktree for the user to review — unless they explicitly ask you to commit.
gh/git is wasted effort.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.