github-deep-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-deep-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Attribution: Sourced from steipete/agent-scripts by Peter Steinberger.
High-confidence, evidence-first, code-aware review. The goal is not a generic summary. The goal is to understand the bug class, find the real cause if possible, decide the best fix after reading enough code, and call out whether a larger refactor would improve the design.
Use gh, not web browsing, for GitHub refs:
gh issue view <n> --json number,title,state,author,body,comments,labels,updatedAt,url
gh pr view <n> --json number,title,state,author,body,comments,reviews,files,commits,statusCheckRollup,mergeStateStatus,headRefName,headRepositoryOwner,url
gh pr diff <n> --patchFor repo-local review, also inspect:
git status --short --branch
git fetch origin
git log --oneline --decorate -20
rg "<key symbol/error/config/endpoint>"Always answer these, explicitly:
Read past the first touched file. Follow the real call path:
When behavior depends on a dependency, read the upstream docs/source/types or current package contract before assuming.
Prefer current source and executable proof over issue comments. Treat stale comments, old CI, and old release behavior as hints until rechecked.
For bug/regression reviews, include a compact Provenance: answer when feasible:
git log -S/-G, git blame, linked PRs/issues, and tests.introduced by, made visible by, or carried forward by.clear, likely, or unknown.Good fixes usually:
Call out when a fix is only symptom-level. If a slightly larger refactor makes the invariant obvious and reduces future bugs, recommend it.
Lead with findings when reviewing a PR. Findings need file/line/symbol references and a concrete failure mode. Avoid vague "consider" comments.
If no blocking issues:
Do not approve, comment, close, merge, push, or land unless the user asked for that action.
For bugs/issues:
main already fixes it.main, only comment/close when the user asks.Ref: #123 / PR #456
Surface: <runtime/CLI/provider/channel/docs>
Bug: <one or two sentences>
Cause: <code path + confidence>
Provenance: <introduced/made visible/carried forward by commit/PR/date, or N/A/unknown>
Best fix: <what should change and why>
Refactor: <yes/no, specific shape>
Proof: <tests/live/CI/source/dependency docs>
Risk: <remaining uncertainty>~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.