flask-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited flask-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Flask is the feedback layer for video. Reviewers hit record and talk through the video (voice, camera, screen, drawing on frames) instead of typing; Flask turns the recording into individual timestamped comments with transcripts and summaries, so you can read every piece of feedback as text anchored to a video timestamp. Typed comments arrive the same way.
All access goes through the Flask MCP server (flask), included with this plugin (https://api.flask.do/api/mcp/mcp). If its tools are unavailable, the user needs to authenticate once: tell them to run /mcp, pick flask, and complete the browser sign-in.
upload_file_start(folder_id, file_size, title, content_type).Find a folder with contents() if you do not have one. The response includes the shareable link.
it right away and watch the upload and processing happen live. Never wait for "ready" to share the link.
next_step(a presigned PUT - the Content-Type header is required).
upload_file_complete(asset_id). The video is watchableinstantly via preview playback. Do not poll asset_status; there is nothing to wait for.
wait_for_feedback(asset_id). It blocks up to ~45s andreturns new feedback the moment it is left. Loop it, passing the returned next_since each time, while the user reviews.
content is the verbatim text of a comment; timestamp is seconds into the video.recording.transcript (what the reviewer said, sliced tothis segment) and recording.ai_summary. Treat the transcript as the feedback.
feedback timestamp from your local render: ffmpeg -ss <timestamp> -i <file> -frames:v 1 /tmp/frame.png and read the image.
the same asset: pass version_of: "<asset_id>" to upload_file_start AND upload_file_complete. Never create a separate asset for a revision.
user keeps one link for the whole iteration.
url.version_stack_url for sharing.team - if the server returns a subscription or entitlement error, relay it to the user verbatim.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.