review-comments — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-comments (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fetch and address review comments on the current PR.
/review-comments
/review-comments 123 # Specific PR numberIf no PR number provided, get it from the current branch:
~/.claude/skills/review-comments/scripts/gh-pr-current-info.shIf the script is unavailable, fall back to:
gh pr view --json number,url,title,headRepositoryOwner,headRepository \
--jq '{number, url, title, owner: .headRepositoryOwner.login, repo: .headRepository.name}'Get PR reviews and comments:
~/.claude/skills/review-comments/scripts/gh-pr-view-reviews.sh {pr_number}If the script is unavailable, fall back to:
gh pr view {pr_number} --json reviews,commentsGet inline code review comments:
~/.claude/skills/review-comments/scripts/gh-pr-comments.sh {owner} {repo} {pr_number}If the script is unavailable, fall back to:
gh api "repos/{owner}/{repo}/pulls/{pr_number}/comments"Lint/typecheck jobs often attach inline annotations to the PR's checks — these surface in the GitHub UI alongside review comments but are NOT review threads, so the comment endpoints above never return them.
# List completed check runs on the PR head, then pull annotations per run
gh pr view {pr_number} --json headRefOid --jq .headRefOid
gh api "repos/{owner}/{repo}/commits/{head_sha}/check-runs" \
--jq '.check_runs[] | select(.output.annotations_count > 0) | {id, name}'
gh api "repos/{owner}/{repo}/check-runs/{check_run_id}/annotations" \
--jq '.[] | {path, line: .start_line, level: .annotation_level, message}'Filter to annotations whose path is in the PR's changed files — drop repo-wide noise (e.g. deprecated-runner warnings on .github). Skip this step silently if no check run has annotations.
Group comments by:
CI annotations are their own category — fix-only: there is no thread to reply to or resolve, so they are addressed in code (or consciously left, e.g. a passing warning) and never appear in the /reply-comments step.
Show a summary of comments:
PR #123: feat(offers-cms): add caching
Reviews:
- amazon-q-developer: 3 comments (2 suggestions, 1 security concern)
- copilot: 1 comment (style suggestion)
- @username: 2 comments (1 question, 1 blocking)
CI annotations (fix-only, no thread):
- Linting: warning at src/foo.tsx:21 — missing useEffect dependency
Unresolved comments: 6Omit the CI annotations block when there are none.
After presenting the summary, ask the user how they'd like to proceed:
Do NOT start making changes or replying without user confirmation.
For each unresolved comment the user wants addressed:
# Stage and commit fixes
git add {files_changed}
git commit -m "address review feedback"
# Push updates
git pushAfter addressing and pushing, ask the user if they'd like to reply. If yes, use /reply-comments to post replies and resolve threads.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.