review-comments — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-comments (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Select and independently validate PR feedback before making focused local changes. This skill owns only the attended local phase: selection, validation, edits, tests, and a local commit. It never publishes a branch, GitHub reply, or thread resolution. /reply-comments owns those separately confirmed remote actions.
/review-comments # PR for the current branch
/review-comments 123 # backward-compatible current-repository selector
/review-comments owner/repo#123 # repository-qualified selector from the watcher
/review-comments owner/repo#123 inline:C1 conversation:I2Trailing stable identities preselect candidates but never authorize an edit or reply.
Accept owner/repo#number or a numeric PR. With no selector, resolve the current branch through:
~/.agents/skills/review-comments/scripts/gh-pr-current-info.shFor a numeric selector, derive owner/repository from the current checkout. For a repository-qualified selector, use its owner/repository for every GitHub call. Fetch PR metadata, head SHA, branch, body, and changed files read-only.
Before offering a local fix, prove that the current directory is a matching checkout:
origin resolves to the selected owner/repository;Never switch branches, create a checkout, fetch, reset, clean, or overwrite unrelated work. If no matching checkout exists, validation and reply preparation may continue from the PR diff, but local fix actions are unavailable. Tell the user which checkout is required.
Use one bounded read-only call:
~/.agents/skills/pr-status/scripts/gh-pr-feedback.py {owner} {repo} {pr_number}Read records, partial, and errors. Preserve each candidate's stable identity, updatedAt, updateKey, stateKey, source, lifecycle, author kind, and targets throughout the run. Never use body text or counts as identity. Pending draft review comments are not observable and must not be invented.
If partial is true, show available records and failed sources. The user may select an available record, but do not infer that an absent record is handled. If the helper is unavailable, the existing gh-pr-view-reviews.sh and the shared inline-comment reader remain a compatibility fallback:
~/.agents/skills/pr-status/scripts/gh-pr-inline-comments.sh {owner} {repo} {pr_number}This Bash helper requires authenticated gh; missing tools or API failures return nonzero. It preserves the legacy single-page response, so label completeness, stable identity and race protection unavailable and do not combine both fetch paths. Keep pr-status installed alongside this skill. The old local gh-pr-comments.sh path forwards to the shared reader for existing permission rules; it is not a second implementation.
Group factual records by author kind, source, lifecycle, semantic type, and collector actionability. These are triage hints, not proof; semantic validity remains agent judgment against evidence.
replies when selected.
adds useful closure. Bot confidence is not evidence.
comment, never an inline reply.
a review thread.
a fix and do not mark it resolved as fixed.
needsClosure: true (outdated, unresolved, no selfreply) still looks ignored on GitHub. List it as a candidate with triage hint needs closure; validate it against current code like any other item, and keep it eligible for an inline reply and thread resolution through /reply-comments.
show separately.
Render a numbered candidate table with PR, stable feedback ID, author/source, lifecycle, bounded gist, and triage hint. No code change occurs before explicit item selection.
Use AskUserQuestion to select identities. When there are four or fewer, use one multi-select question with one option per identity. For a larger inventory, ask in priority batches of at most four and leave unselected items untouched; the user may type an exact list of IDs. Preselected IDs from arguments still require this current-run confirmation. Selecting an item authorizes only read-only validation, not a fix or publication.
For each selected identity, read the full record, referenced path/line, current implementation, relevant PR diff, requirements, existing tests, and CI. Do not trust the reviewer wording. Choose one outcome and cite concrete evidence:
confirmed defectvalid improvementquestion needing an answersubjective/trade-off decisionfalse positive/already handledstale/outdatedout of scopeunable to validateState confidence as high, medium, or low and name missing evidence. Security, architecture, scope-changing, ambiguous, or low-confidence feedback always returns to the user; never auto-fix it. Re-read the item against current code before any later edit. If the feedback became stale, outdated, resolved, or already handled, update the outcome and do not edit.
Show the validation result first. Then use AskUserQuestion for each item, batching at most four questions per call, with only eligible choices:
improvement in a matching checkout.
GitHub action.
Questions and trade-offs default to Prepare reply or defer. Security, architecture, scope-changing, ambiguous, and low-confidence items offer discussion/defer choices only. A custom answer may narrow a requested fix but is not remote-action permission.
For each approved fix or coherent selected group:
Do not skip verification, bypass hooks, amend unrelated commits, or claim a fix without a successful local commit. If tests fail, stop and keep remote actions unavailable. If multiple items require unrelated changes, use separate commits. This skill does not publish the commit.
#### Reopen the bead after a committed fix
A PR workflow closes its bead when the PR is created. Reopen it only when this run produced a successful local commit for at least one selected confirmed defect or accepted valid improvement. Replies, acknowledgements, deferrals, false positives, and uncommitted edits never change bead state.
obvious one-to-one correspondence. If none match, skip silently. If several match, ask which one; never guess.
bd list --status=closed ~/.agents/skills/next/scripts/next-select resolve <bead-id>On ambiguous, unavailable, or not-found, reopen nothing and report the routing problem. If the bead is already in_progress, leave it unchanged.
claim attribution:
~/.agents/skills/next/scripts/next-select start <bead-id>This local reopen does not authorize a push, reply, or resolution. If reopening fails, preserve the commit and report the bead mismatch; remote handoff preparation may continue.
Draft replies only for selected items. Keep a bounded session ledger keyed by repository/PR/identity/updateKey with validation, files/tests, commit SHA, intended reply surface, prepared body, and resolution eligibility.
Do not call a reply, conversation-comment, or resolution helper here. Render the exact next command:
/reply-comments owner/repo#123 identity1 identity2 .../reply-comments must independently re-fetch and reconfirm push, posting, and resolution.
Map every selected record, including deferred and skipped items:
| Feedback ID | Validation | Files/tests/commit | Push state | Reply | Resolution |
|---|
Use local only for a new commit, not applicable when no change was made, prepared/not posted for drafts, and not attempted for remote actions. Include unresolved uncertainty and the repository-qualified /reply-comments handoff when anything is prepared.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.