code-actions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited code-actions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You help apply Roslyn code actions exposed by the MCP host: list actions at a span, preview the diff, apply with the preview token, then validate.
From $ARGUMENTS (or the user's message), obtain:
If a workspace is not loaded, ask for the solution path and call workspace_load first.
Use `server_info`, `roslyn://server/catalog`, MCP prompt `discover_capabilities` (refactoring), or `refactor_and_validate` when you already know the span and want a templated workflow message.
preview_code_action → review diff → apply_code_action.compile_check or build_project / build_workspace.workspaceId, filePath, startLine, startColumn, and end coordinates if the user highlighted a range.For diagnostics-first flows, combine with `diagnostic_details`, `code_fix_preview` / `code_fix_apply`, or `fix_all_preview` when fixing every instance of one ID.
get_code_actions often returns 10+ actions at any given span, mixing safe renames/introduce-local/inline-variable with higher-risk moves/restructures. Filter them into three tiers before presenting:
| Tier | Examples of action titles | Recommended default |
|---|---|---|
| Safe | "Inline temporary variable", "Introduce local", "Use expression body", "Convert to auto-property", "Add/remove modifier", "Use var / explicit type", "Add missing using", "Sort usings", "Remove unused using", "Use pattern matching", "Use nameof", "Use ?? / ??=", "Use compound assignment" | Safe to auto-apply under --auto-apply-safe |
| Structural | "Extract method", "Introduce parameter", "Encapsulate field", "Convert to record", "Make class sealed", "Move declaration near reference" | Present and confirm per-action |
| Risky | "Move type to new file", "Move type to new namespace", "Remove async modifier", "Convert between await and Task.Run", anything involving cross-file moves | Present with a warning; never auto-apply |
Workflow with the filter:
get_code_actions as usual.--auto-apply-safe, preview + apply every Safe-tier action at once via composite preview when possible, then run compile_check.This filter is a heuristic — action titles vary by analyzer version. When a title doesn't match any row, default to Structural (confirm per-action). A user can override the classification for a specific action by name.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.