reviewing-code — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited reviewing-code (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Structured review methodology producing consistent, severity-based, actionable feedback. This skill defines the review process — how to conduct a review, format findings, and decide; the what to look for lives in perspective reference files the orchestrator loads selectively. Non-code artefacts use assessing-quality (rageatc-core-oss); architecture design review is the critic's job at architecture approval.
Perspectives are reference files under references/ defining what to examine. The orchestrator tells the reviewer-agent which to load.
| Reference | Focus | Typical use |
|---|---|---|
references/spec-compliance.md | Does code match the brief and acceptance criteria? | All tiers — always loaded |
references/code-quality.md | Correctness, simplicity, readability, test quality | Standard + Thorough |
references/security.md | Input validation, injection, auth, data exposure | Thorough, or when chunk handles user input |
references/whole-project.md | Full codebase against PRD success criteria | End of Standard/Thorough build only |
references/design-compliance.md | UI matches system.md tokens, depth, patterns | Standard + Thorough, when project has system.md and chunk touches UI |
Tier defaults (orchestrator may override — e.g., security for a Quick auth fix):
| Tier | Perspectives loaded |
|---|---|
| Quick | spec-compliance |
| Standard | spec-compliance → code-quality → design-compliance (if system.md exists and chunk touches UI) |
| Thorough | spec-compliance → code-quality → design-compliance (if applicable) → security (as needed) |
| End-of-build | whole-project (standalone, against PRD not brief) |
# Code Review: [chunk name/ID]
**Brief:** [reference to development brief or roadmap chunk]
**Perspectives:** [which perspectives were applied]
**Decision:** Accept / Revise
**Findings:** [count by severity]
## Findings
[Findings grouped by severity: critical first, then major, minor, notes]
## What Works Well
[Brief acknowledgement of what meets standards]
## Decision
[Accept or Revise with rationale]
## Observations
[Anything relevant to the broader project but outside this chunk's scope]**[SEVERITY]** file:line (or component)
_Finding:_ What the issue is.
_Impact:_ Why it matters.
_Suggestion:_ How to fix it.Example:
**[MAJOR]** src/validators/email-validator.ts:1-45
_Finding:_ Email validation uses an abstract factory pattern with three
interfaces and a plugin system. The actual validation is 4 lines of code
wrapped in 40 lines of abstraction.
_Impact:_ Maintenance burden disproportionate to the problem. Future
developers must understand the factory pattern to modify a simple check.
Violates simplicity principle.
_Suggestion:_ Replace with a direct validation function. If additional
validators are needed later, extract a pattern then — not before.| Level | Meaning | Examples |
|---|---|---|
| Critical | Blocks acceptance. Must fix. | Acceptance criterion not met, security vulnerability, data loss risk, tests broken |
| Major | Degrades quality significantly. Should fix. | Unhandled error causing user-facing failure, missing test for core logic, architectural pattern violation |
| Minor | Improves quality. Desirable but does not block. | Naming could be clearer, minor duplication, missing edge case test for non-critical path |
| Note | Observation only. No action required. | Worth knowing for future work, pattern that could become a problem at scale |
Severity honesty: do not inflate. A naming improvement is not critical; inflation erodes trust and wastes developer cycles. Security findings are never below Major — exploitable vulnerabilities are Critical — even when spec-compliance passes (calibration table in references/security.md).
Accept — all of: zero critical findings, zero major findings, all acceptance criteria satisfied, tests pass. Minor findings and notes are included but do not block.
Revise — any of: a critical or major finding, an unsatisfied acceptance criterion, failing tests (unless explained by an intentional, brief-sanctioned change). List the specific issues requiring revision.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.