why-comments — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited why-comments (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Comments fail in two opposite directions. Agents (and tired humans) write narration — // loop over the users, // call the API — that restates what the code already says, goes stale the moment the code changes, and trains every reader to skip comments entirely. Meanwhile the one thing a comment can do that code can't — record why — goes unwritten: why the retry is 3 and not 5, why this runs before that, why the obvious approach was tried and reverted. Six months later someone "simplifies" the workaround and reintroduces the bug it guarded against.
This skill inverts the ratio: delete the whats, keep and sharpen the whys, and add a why where surprising code has none.
explain-back flagged a chunk UNJUSTIFIED and the justification, once found, should be written downDon't use when: the comments are API documentation (docstrings, JSDoc, godoc) — those describe a contract for consumers and are a different job, judged by different rules. And don't add a why where the code is genuinely self-evident; a comment on the obvious is noise wearing a justification.
Walk the comments and tag each one:
// check if the user is active above if (user.isActive))// gateway rate-limits at 10 rps; see INC-482)delete-this territory; version control already remembers itRemove narration outright. If a WHAT comment exists because the code underneath is unclear, the fix is the code, not the comment — usually a better name (name-things) or a small extraction. The comment was a crutch; replace the leg, don't decorate the crutch.
A surviving why must state the actual constraint, not gesture at it:
Bad:// don't change thisGood:// keep the 250ms floor: the gateway silently drops sub-250ms retries (vendor ticket #4821); removing it re-opens INC-482
Scan for code that would make a new reader stop — magic values, deliberate no-ops, order-dependent calls, an approach that looks worse than the obvious one. Each gets one line of why. If you can't find the why (git blame, history, asking), don't invent one — flag it UNJUSTIFIED exactly as explain-back would, and surface it to the human.
If CONTEXT.md records conventions (comment density, ticket-link format, language), follow them. A repo that links incidents as INC-123 shouldn't get prose paragraphs.
DELETED (narration — code already says it)
- <file:line> — "<comment>" (restates the code)
KEPT & SHARPENED (real whys)
- <file:line> — before: "<vague>" → after: "<constraint + evidence + what breaks>"
ADDED (surprising code that had no why)
- <file:line> — why: <the constraint, one line>
UNJUSTIFIED (no why found — needs a human)
- <file:line> — <what's surprising and what was checked (blame, history)>| Anti-Pattern | Why it defeats the skill |
|---|---|
| Narrating the next line | Restates the code, rots on the next edit, and teaches readers to skip all comments — including the load-bearing ones. |
// don't touch this with no reason | A warning without a why gets ignored or, worse, obeyed forever after the constraint is gone. |
| Inventing a plausible why | A confident wrong justification is worse than UNJUSTIFIED — it ends the investigation at the wrong answer. |
| Fixing unclear code with a comment | If the code needs narration to be readable, fix the names or the structure. The comment is the symptom. |
| Deleting a why you don't understand | That comment may be the only record of the constraint. Verify it's obsolete before it goes. |
Code says what; comments owe you why. Delete every comment the code can say itself, and make the survivors carry the one thing code never can — the reason.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.