wjs-looping-feedback — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited wjs-looping-feedback (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Installs a self-driving feedback loop into any website repo. Runs entirely on the repo owner's own GitHub Actions, authenticated with their Pro/Max OAuth token or their own ANTHROPIC_API_KEY — no extra service or backend.
.github/workflows/feedback.yml — allowlist gate → Claude Code Action → auto-commit →push to main (auto-deploy) → ledger + dashboard update → close issue.
/_feedback dashboard — every suggestion, what Claude did, commit, status, one-click revert..feedback/ runtime: feedback-lib.mjs, feedback-finalize.mjs, INSTRUCTIONS.md,feedback-ledger.json, config.json.
visitor clicks button → fills suggestion → prefilled GitHub Issue (label feedback) → Actions checks the author is in FEEDBACK_ALLOWLIST (else closes the issue) → Claude Code edits the site per .feedback/INSTRUCTIONS.md → workflow commits to main, updates the ledger + dashboard → the deploy ships it → the issue gets a comment with the commit and a link to /_feedback. Revert is the same loop driven by a revert: #N issue.
The workflow pushes to main with the built-in GITHUB_TOKEN. Two cases:
webhook fires on every push, so the bot's commit deploys automatically. Nothing to do.
Actions): GitHub deliberately does NOT let a GITHUB_TOKEN push trigger another workflow (recursion prevention), so the deploy workflow's on: push will NOT fire — the change lands on main but never goes live. Bridge it by adding a workflow_run trigger to the deploy workflow (see references/install.md step 4.5).
Read references/install.md and follow it in the target repo. It detects the site type (Hugo / Next.js / Astro / static), copies assets, injects the widget, and asks the user for exactly two things: the allowlist of GitHub usernames and the auth (Pro/Max OAuth token via claude setup-token, or an ANTHROPIC_API_KEY).
Runs in the user's own repo with their own auth. Submitters need a GitHub account; only allowlisted authors trigger work. Not a hosted service — no anonymous submit, no billing, no multi-tenant. (A future GitHub-App packaging would reuse every asset here.)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.