using-reviews-locally — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-reviews-locally (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill for local Reviews workflows from a checkout of this repo.
Use the project script:
lsof -iTCP:4000 -sTCP:LISTEN
./bin/serverDo not run mix phx.server directly unless you know OAuth/env loading is unnecessary. ./bin/server sources .env.local and runs Phoenix on http://localhost:4000.
The CLI reads ~/.config/reviews/config.toml and currently uses [default].
Expected shape:
[default]
server_url = "http://localhost:4000"
api_token = "rev_..."If the user's real default points to Fly, avoid editing it casually. For one-off local pushes, create a temporary home/config:
mkdir -p /private/tmp/reviews-local-home/.config/reviews
# write /private/tmp/reviews-local-home/.config/reviews/config.toml
HOME=/private/tmp/reviews-local-home cli/target/release/reviews push --update <slug>Preferred path:
http://localhost:4000/settings.Fallback for Codex when the local signed-in user exists and direct DB access is appropriate:
POSTGRES_HOST=localhost POSTGRES_PORT=<port> mix run -e 'user = Reviews.Repo.get_by!(Reviews.Accounts.User, username: "local-codex"); {:ok, _token, raw} = Reviews.Accounts.mint_token(user, %{"name" => "codex-local-push"}); IO.puts(raw)'Find the DB port by inspecting the running BEAM process connections if needed:
lsof -nP -iTCP:4000 -sTCP:LISTEN
lsof -p <beam-pid> | rg "localhost:.*->localhost:"Local and hosted tokens are not interchangeable.
Create a new review:
cli/target/release/reviews push --packet /path/to/packet.mdAppend a patchset:
cli/target/release/reviews push --update <slug> --packet /path/to/packet.mdPush current uncommitted work:
cli/target/release/reviews push --update <slug> --range HEAD --packet /path/to/packet.mdIf the sandbox blocks localhost networking, rerun the CLI with escalation. If the token is rejected, mint a token in the same local database as the running server.
/private/tmp unless the user asks to commit them.mix compile --warnings-as-errors, mix format --check-formatted, and mix assets.build after relevant code/CSS/JS changes.mix test fails before tests run because DB config points at the wrong local Postgres, report that separately from app failures.From this repo, symlink shared skills into Codex's skill directory:
ln -s "$PWD/skills/reviews-overview" "$HOME/.codex/skills/reviews-overview"
ln -s "$PWD/skills/writing-review-packets" "$HOME/.codex/skills/writing-review-packets"
ln -s "$PWD/skills/using-reviews-locally" "$HOME/.codex/skills/using-reviews-locally"If a destination already exists, inspect it before replacing it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.