Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding…
SaferSkills independently audited code-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Two-axis review of the diff between HEAD and a fixed point the user supplies:
Both axes run as parallel sub-agents so they don't pollute each other's context, then this skill aggregates their findings. Start every sub-agent with a fresh context window.
The issue tracker should have been provided to you. If not, tell the user to run /setup-matt-pocock-skills.
Whatever the user said is the fixed point (a commit SHA, branch name, tag, main, HEAD~5, etc.). If they didn't specify one, ask for it.
Capture the diff command once: git diff <fixed-point>...HEAD (three-dot, so the comparison is against the merge-base). Also note the list of commits via git log <fixed-point>..HEAD --oneline.
Before going further, confirm the fixed point resolves (git rev-parse <fixed-point>) and the diff is non-empty. A bad ref or empty diff should fail here, not inside two parallel sub-agents.
Look for the originating spec, in this order:
#123, Closes #45, GitLab !67, etc.), fetched via the workflow in the tracker doc.docs/, specs/, or .scratch/ matching the branch name or feature.Search the repo for every file that documents how code should be written. When CODING_STANDARDS.md or CONTRIBUTING.md exists, it must be on the list.
On top of whatever the repo documents, the Standards axis always carries the smell baseline below: a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it:
Each smell reads what it is → how to fix; match it against the diff:
switch/if-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share.a.b().c().d() navigation the caller shouldn't depend on. → hide the walk behind one method on the first object.Issue both sub-agent calls together, in the foreground, and aggregate the reports they return.
Standards sub-agent prompt should include:
Spec sub-agent prompt should include:
If the spec is missing, skip the Spec sub-agent and note this in the final report.
Present the two reports under ## Standards and ## Spec headings, verbatim or lightly cleaned. Do not merge or rerank findings, because the two axes are deliberately separate (see _Why two axes_).
End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes: that's the reranking the separation exists to prevent.
A change can pass one axis and fail the other:
Reporting them separately stops one axis from masking the other.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.