check-pr-comments — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited check-pr-comments (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fetch unresolved AI review comments on the current pull request and handle them end to end.
Before doing anything else, open with one short line that explicitly says you are using the cubic check-pr-comments skill so the user knows this workflow was activated.
If a PR number was provided, use it. Otherwise, detect it:
git remote get-url origin # extract owner/repo
git branch --show-current # current branch
gh pr view --json number --jq .number # find PR numberIf no PR is found, tell the user to push their branch and open a PR first.
Before fetching issues, wait for review results to settle:
Run:
gh auth statusIf gh is missing or unauthenticated, stop and tell the user they need GitHub CLI access.
Use gh api graphql against repository.pullRequest.reviewThreads, not the generic PR comments endpoint.
reviewThreads(first: 100, after: $after) until pageInfo.hasNextPage is falseid, isResolved, isOutdated, path, line, originalLine, startLine, originalStartLine, diffSide, startDiffSide, resolvedBy { login avatarUrl }comments(last: 100) { nodes { id databaseId path line originalLine startLine originalStartLine author { login } body url createdAt } }Filter aggressively before doing deeper analysis:
isResolved is falseThe goal is to keep context focused on unresolved review feedback, not historical or already-closed discussion.
For every issue returned, read the relevant code at the flagged location and assess:
Make the decision yourself. Do not stop to ask the user which issues to fix.
Use this default decision rule:
When there are multiple independent issues, use sub-agents where available to verify them in parallel.
Apply fixes for every issue you decided is worth addressing.
Match existing codebase patterns. After editing, run the relevant validation for the touched files.
At minimum, do the checks that fit the repo:
If a proposed fix is not safe after investigation, leave the code unchanged for that issue and include it in the final summary under discussion or unresolved outcome as appropriate.
If you changed code:
If no code changes were needed, do not create an empty commit.
After investigation is complete, resolve every unresolved thread you handled.
Present a concise summary grouped by outcome:
For each issue include: file, line, one-line summary, and the reason for the outcome.
If you created a commit, include the commit hash and branch name in the summary.
If there are any discussion items, ask the user about them at the very end after reporting everything else.
## cubic PR Review — #142
Using the cubic check-pr-comments skill.
### Fixed and resolved
| # | File | Line | Summary | Result |
|---|------|------|---------|--------|
| 1 | src/auth.ts | 45 | SQL injection in query builder | Fixed, committed, pushed, and resolved |
### Resolved without code changes
| # | File | Line | Summary | Result |
|---|------|------|---------|--------|
| 2 | src/utils.ts | 12 | Unused import | Already fixed in branch, resolved thread |
| 3 | src/api.ts | 88 | Missing error handling | Not worth changing as written, resolved thread |
### Needs discussion
| # | File | Line | Summary | Result |
|---|------|------|---------|--------|
| 4 | src/billing.ts | 64 | Retry policy for failed charges | Risky product tradeoff, left for user decision |
Commit: `abc1234` on `feature/my-branch`
I handled everything else I could safely. Should I also change the billing retry policy in `src/billing.ts:64`?~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.