Is doncheli-pr-review-58ca8b safe to install?

SaferSkills independently audited doncheli-pr-review-58ca8b (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.opencode/skills/doncheli-pr-review/SKILL.md · 1 file

.opencode/skills/doncheli-pr-review/SKILL.md1.7 KB · Markdown

name: doncheli-pr-review

description: Perform a structured code review of a pull request aligned with SDD principles. Activate when user mentions "PR review", "pull request", "review PR", "code review", "review this diff".

Don Cheli: PR Review

Instructions

Accept a PR number, URL, or diff as input
Fetch the diff using gh pr diff <number> or read the provided diff
Review in this sequence:

Spec alignment: does the code implement what the spec says? Flag any drift
Tests: are new behaviors covered? Is coverage maintained above 85%?
Code quality: complexity, duplication, naming, error handling
Security: OWASP Top 10 surface, secrets in code, input validation
Breaking changes: API contract changes, schema migrations, deprecations

Categorize each finding: [blocker | warning | suggestion | nitpick]
Blockers must be resolved before merge — list them prominently
Never approve a PR with unresolved blockers
Generate a structured review comment ready to post with gh pr review
If spec docs are missing for a non-trivial feature, flag as a warning

Output Format

## PR Review — #142 "feat: add voice mode integration"

### Spec Alignment ✅
All scenarios in specs/voice.feature are covered by the implementation.

### Blockers 🔴
1. src/voice/transcriber.ts:34 — API key hardcoded. Must use env var VOICE_API_KEY.

### Warnings 🟡
1. src/voice/transcriber.ts — coverage 72%, below 85% threshold.
2. No migration doc for the new voice_sessions table.

### Suggestions 🟢
1. Consider extracting the cleanup logic at line 88 into a private method.

### Nitpicks
1. Line 12: typo "recieve" → "receive"

### Verdict: CHANGES REQUESTED
Resolve 1 blocker before merging.

doncheli-pr-review-58ca8b— agent skill

Is doncheli-pr-review-58ca8b safe to install?

Don Cheli: PR Review

Instructions

Output Format

Audit the pieces. Scan the whole. Decide.