4r-code-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited 4r-code-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when a coding task is reported complete and BEFORE declaring it done, committing, pushing, or opening a PR — especially when the change was produced wholly or partly by a coding agent.
Use it to run a systematic, stack-agnostic review across four dimensions — Risk, Readability, Reliability, Resilience — that classifies findings by severity, surfaces fixable defects, and returns an explicit accept/block decision.
Do NOT use this skill to write the feature, design architecture from scratch, or audit non-code artifacts (use reviewer for PRDs, specs, and API contracts). This skill reviews a code diff, not prose.
git diff / git diff --staged (and git status) to get exactly what changed. Review the diff and its blast radius, not the whole repo.references/4r-dimensions.md. Prioritize the AI failure patterns listed there — agent code passes the eye test and fails differently than human code.| R | Central question | Covers |
|---|---|---|
| Risk | Does this add disproportionate risk to security or production? | Auth, secrets, trust boundaries, input validation, injection, blast radius, rollback. |
| Readability | Can another engineer maintain this without rebuilding the author's intent? | Naming, structure, duplication, complexity budget, AI slop. |
| Reliability | Is there real evidence it works on normal AND edge inputs? | Tests that catch bugs, edge cases, error handling, timeouts, correctness. |
| Resilience | When it fails, does the system recover or cascade? | Retries with backoff, fallback, graceful degradation, observability, isolation. |
Full per-dimension checklists, AI-specific failure patterns, and acceptance criteria are in references/4r-dimensions.md — read it before the 4R passes.
| Situation | Action |
|---|---|
| Diff is trivial (docs, comments, formatting) | Quick pass: intent match + Risk scan only; skip deep 4R. |
| Diff touches auth, secrets, payments, data, or infra | Full 4R + mandatory Escalate consideration; no Blockers allowed. |
| Agent-generated logic, new integration, or 2+ files | Full 4R; prioritize AI failure patterns and test quality. |
| Tests absent where change warrants them | Reliability ≤ 1; Request changes unless risk is low AND justified in writing. |
| Blocker in Risk or Resilience | Block. Do not approve regardless of other scores. |
| Change exceeds reviewer's authority or domain | Escalate to specialized/human review. |
| Severity | Meaning |
|---|---|
| 🔴 Blocker | Probable vulnerability, data loss, critical regression, plausible cascade, unbounded risk in a sensitive zone. |
| 🟠 High | Missing tests on a critical path, absent timeout, wrong retry, excessive complexity in core logic, weak observability at a critical point. |
| 🟡 Medium | Improvable readability, bounded uncovered edge case, documentable debt without immediate impact. |
| 🔵 Low | Naming, minor structure, non-critical simplification. |
Score each R 0–2 (0 = insufficient, 1 = acceptable with reservations, 2 = solid). Merge rule: minimum 1 per dimension, no 0 in Risk or Resilience, target average ≥ 1.5. Any security Blocker or plausible cascade invalidates the aggregate until fixed.
Produce the report in assets/4r-review-report.md. Required sections: Context, one block per R (verdict Pass/Concern/Block + findings table), a severity-tagged findings list, the 0–2 scorecard, and a Final Decision (status + residual risk + required actions before merge + follow-ups). End with one explicit sentence: whether the change may be committed/pushed or must return to iteration.
Before returning the review, verify:
references/4r-dimensions.md — per-dimension checklists, AI failure patterns, acceptance criteria. Read before the 4R passes.assets/4r-review-report.md — report template. Fill for every review.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.