code-subagents — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited code-subagents (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fresh subagent per task. Two-stage review after each. Parallel when independent, sequential when dependent.
Use when:
Don't use when:
Tasks with dependencies execute one at a time. Each gets a fresh subagent — no context pollution from previous tasks.
Task 1 (Entity) → review → complete
Task 2 (Repository, depends on T1) → review → complete
Task 3 (Service, depends on T2) → review → completeIndependent tasks dispatch simultaneously. One agent per problem domain.
Task A (auth tests) ──→ review → complete
Task B (billing tests) ──→ review → complete ← concurrent
Task C (notification tests) ──→ review → completeIndependence check: Would fixing Task A affect Task B? Would they edit the same files? If no to both, dispatch in parallel.
Use these templates when dispatching subagents. Each template is battle-tested — don't improvise, use them as-is and fill in the variables.
read the plan file; provide the full task text
| Mistake | Fix |
|---|---|
| "Fix all the tests" | "Fix the 3 failures in user.test.ts" |
| No context about codebase | Paste the relevant patterns and conventions |
| No constraints | "Do NOT change production code" or scope to specific files |
| Vague output expectations | "Return: root cause, changes made, test results" |
Every completed task gets two reviews in order. Do not skip either. Do not reverse the order.
Does the implementation match what was specified?
## Spec Review
Review the implementation against the task specification:
**Task spec:** [paste task from plan.json]
**Files changed:** [list from subagent output]
Check:
1. Are all requirements from the task spec implemented?
2. Is anything implemented that wasn't specified? (over-building)
3. Do tests cover the specified acceptance criteria?
4. Does the implementation match the design in design.md?
Report: List any gaps or extras. Mark ✅ if compliant, ❌ if not.If the spec reviewer finds issues → the implementer subagent fixes them → spec reviewer reviews again. Repeat until ✅.
Is the implementation well-built?
## Code Quality Review
Review the implementation for code quality:
**Files changed:** [list]
Check:
1. Does the code follow existing patterns and conventions?
2. Are tests meaningful (not just asserting true)?
3. Is there unnecessary complexity?
4. Are edge cases handled?
5. Is the code clean (no dead code, no unnecessary comments)?
Rate issues as Critical (blocks merge), Important (should fix), or Minor (nice to have).If the quality reviewer finds Critical or Important issues → implementer fixes → reviewer reviews again. Minor issues can be noted and moved past.
Spec compliance first because there's no point polishing code that doesn't meet the spec. Quality second because compliant code still needs to be well-built.
Subagents may ask questions before or during implementation. This is good — it means they're thinking rather than guessing.
After subagents complete (especially parallel dispatch):
bd close <id>, or harness todo listIf there are conflicts between parallel results, resolve them manually. Don't dispatch another subagent to merge — that requires too much context.
If a subagent fails a task:
If failure reveals a design problem:
"This task is failing because [reason]. The design in design.md may need to change. Want me to go back to spec-brainstorm?"
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.