review-inbox — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-inbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
找出 team 內需要自己 first review、re-approve、或 re-review 的 PR,批次執行 review, 並依來源回 Slack 通知。
此 skill 只處理多 PR discovery + batch review orchestration。單一 PR URL 轉 review-pr; 「我的 PR」approval 狀態轉 check-pr-approvals。
支援三個來源:
| Source | Use when |
|---|---|
| Slack | 預設;掃 PR channel 最近訊息中的 PR URLs |
| Thread | 使用者提供 Slack thread URL 並要求 review |
| Label | 使用者明確提到 need review label |
不得 review 自己的 PR。不得對 waiting_for_author PR 重複 review。 Review inbox 屬 reviewer-side read-only lane;它可以 advisory,但對 awaiting_re_review、 mergeable_ready、unsupported_mutation、changes_requested 的解釋必須沿用 shared PR state。 它不得把 batch review 結果升格成 author-side completion / release authority;所有 「可 merge / 已修完 / 可 release」語句只能轉述 shared state,不可自行推論。
| Situation | Load |
|---|---|
| Any run | context-budget-contract.md, review-inbox-discovery-flow.md, shared-defaults.md, stale-approval-detection.md, workspace-config-reader.md |
| Batch review execution | review-inbox-batch-review-flow.md, review-inbox/dispatch-context-bundle.md |
| Slack notification | review-inbox-slack-reporting.md, slack-message-format.md, github-slack-user-mapping.md, workspace-language-policy.md |
Slack channel scan 可以派 read-only sub-agent。Per-PR review 不得使用 Claude Code general-purpose sub-agent;只有 runtime 提供 constrained code-reviewer adapter 時才可平行 dispatch。否則依 build-review-runtime-plan.py 產生的 main_session_sequential plan,一次執行 一個 review packet,完成後只把 Completion Envelope summary 留在主 context。Batch review dispatch 由 main session 讀取 dispatch-context-bundle.md 一次,再把濃縮後的 review flow inline 注入每個 review packet;不得要求執行者重讀完整 review skill / reference stack。
batch size、concurrency、confirm setting。
Slack channel scan 使用 MCP 時指定 concise output;fallback CLI 的 --oldest 可接受 Slack timestamp 或 ISO date/datetime。
annotate-review-candidates.py enrich,補上 sister PR clustermetadata 與 model_tier semantic class。Slack mapping 若含 root_ticket_key,cluster 必須優先使用 root ticket;若沒有 umbrella ticket 但同一 Slack root message 有可辨識 topic,使用 root_topic_key;最後才 fallback 到每張 PR 自己的 ticket。
build-review-prompt.sh 產生 review packets + manifest,再用build-review-runtime-plan.py 產生 runtime plan。Plan 必須禁止 general-purpose sub-agent; 若無 constrained code-reviewer adapter,主 session 依 sequential plan 執行。
deterministic handbook resolver 列出已存在的 project handbook paths,空清單時明確標示 no project handbook。Prompt 必須要求執行者先讀 changed-file names,再依 diff size sampling;existing inline comments 只能以 metadata-only dedup,不把完整 comment body 放進 context。Cluster lead 先跑完整 review;cluster sibling 使用 sibling-diff mode 與 small_fast model class hint,不確定時標記 needs_standard_review。
measure-review-inbox-session.sh 產生 telemetry JSON,並用polaris-learnings.sh add --type telemetry --tag review-inbox 寫入 metadata.review_inbox_run。若無法取得完整 transcript,仍需用 line-count proxy 記錄 candidate count、reviewed count、runtime plan kind 與 artifact volume。
review-pr 流程負責。workspace-language-policy.md language gate。reply_broadcast: true。輸出 reviewed count、APPROVE / REQUEST_CHANGES / COMMENT counts、Slack notification count、 任何 blocked PR 的原因,以及 telemetry run_id。Telemetry 可用:
POLARIS_WORKSPACE_ROOT={workspace_root} .claude/skills/references/scripts/polaris-learnings.sh query --type telemetry --tag review-inbox查到 metadata.review_inbox_run.main_session_input_tokens。
Execute post-task-reflection-checkpoint.md before reporting completion.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.