cubic-loop — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cubic-loop (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Iteratively review and fix code until cubic finds no more issues: review -> fix -> re-review -> repeat.
local (default) for CLI review, or pr for PR-based review.Check whether to use local CLI or PR-based review:
For local mode, verify the CLI is installed:
which cubicIf not found, show install instructions and stop:
curl -fsSL https://cubic.dev/install | bashFor PR mode, verify GitHub CLI access:
gh auth statusIf gh is missing or unauthenticated, stop and tell the user they need GitHub CLI access for PR mode.
Then identify the PR:
gh pr view --json number,headRefName -q '{number: .number, branch: .headRefName}'Repeat the following cycle.
#### A. Run review
Local mode:
git status --porcelain
# If uncommitted changes: cubic review -j
# If clean working tree: cubic review -b -jIf local review output is queued/running (or no final issues array is available yet), poll until complete:
PR mode:
git pushThen wait for GitHub/PR review results to settle before fetching issues:
After completion, use gh api graphql against repository.pullRequest.reviewThreads.
reviewThreads(first: 100, after: $after) until pageInfo.hasNextPage is falseid, isResolved, isOutdated, path, line, originalLine, startLine, originalStartLine, diffSide, startDiffSide, resolvedBy { login avatarUrl }comments(last: 100) { nodes { id databaseId path line originalLine startLine originalStartLine author { login } body url createdAt } }Prefer unresolved, non-outdated review threads. If the author identity is available, focus on comments authored by cubic's bot/app; otherwise, use the PR's review comments and note that the source could not be narrowed to cubic with certainty.
#### B. Check exit conditions
Stop the loop if ANY of these are true:
#### C. Fix issues
For each issue, prioritized P0 first then P1, P2:
When there are multiple independent issues, use sub-agents where available to verify and fix them in parallel.
Skip P3 issues unless the user explicitly requested "fix everything".
#### D. Commit and continue
git add -A
git commit -m "fix: address cubic review feedback (iteration N)"Go back to step A.
After exiting the loop, present a summary.
Clean exit:
## Cubic Loop Complete
Iterations: 2
Issues fixed: 5
Remaining: 0
Changes:
- Iteration 1: Fixed SQL injection (P0), added null checks (P1 x2)
- Iteration 2: Fixed error handling (P2), added input validation (P2)
All commits pushed. Ready to merge.Max iterations reached:
## Cubic Loop — Stopped after 5 iterations
Iterations: 5
Issues fixed: 11
Remaining: 2
Remaining issues:
- src/legacy.ts:234 — P2: "Consider extracting this into a utility function"
- src/config.ts:12 — P3: "Magic number could be a named constant"
These may be intentional trade-offs. Review manually or run again.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.