python-clean-code — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited python-clean-code (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reviews Python code in gsc-mcp for quality issues. Read-only analysis: produces a findings report, applies no fixes.
Invoke before opening a PR, after adding a new tool, or when a module feels hard to read. Pass a file path or module name as the argument.
Flag any function exceeding 30 lines (excluding docstring and blank lines). A function that does more than one thing usually has a name with "and" in it, or a docstring that lists multiple behaviors. Each tool function in tools/ should do exactly one thing: call the API, transform the response, and return the JSON string.
Every function signature must be fully annotated. Check for:
-> str:, -> None:)Any without justificationlist and dict without subscripts where the shape is known (e.g. list[dict] not just list)Private helpers must start with _. Constants at module level must be in _SCREAMING_SNAKE_CASE. Tool functions exposed to MCP must be lowercase with underscores. No abbreviations that require context to decode (r for rows; svc is acceptable because it appears consistently across the codebase).
Tool functions must not silently swallow exceptions. They may catch specific exceptions to convert them into user-friendly error messages, but they must not use bare except: or except Exception: without re-raising or returning a structured error response. Transient Google API errors belong in retry.py, not in tool functions.
Check for logic duplicated across modules. Common candidates: date range calculation (already in analytics._date_range), URL normalization (already in cross._normalize_url), dimension filter construction (already in ga4._build_dimension_filter). If a function re-implements one of these, flag it.
Every public tool function must return json.dumps(with_meta(...)). Flag any function that:
json.dumps({...}) without with_meta"data" key inside with_metaMCP uses the function docstring as the tool description visible to the user. The docstring must be present, must describe what the tool does (not how), and must mention key parameters and any data lag (GSC has a 3-day lag by default).
## Clean Code Review: <file>
### Critical
- [function:line] [issue]: [why it matters]
### Improvement
- [function:line] [issue]: [suggested fix]
### Minor
- [function:line] [issue]
### Passed
- Type hints: complete on all public functions
- Output contract: all tools use with_metaEvery finding must cite the exact function name and line number. Do not flag something as a violation without reading the code to confirm it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.