faces-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited faces-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Version 1.2.3
Review the Jakarta Faces code in $ARGUMENTS (if no argument, scan the project for .xhtml and backing bean files) against the rules in .claude/faces/rules.md and its topic files.
<!DOCTYPE html> is used, not XHTML doctype.UIForm components.UIInput and UICommand components are inside UIForm.UIInput has a corresponding UIMessage.UIMessages with redisplay="false" exists in each view; when using ajax, its ID is covered by render/update.NamingContainer, UIInput and UICommand components have explicit IDs (no generated IDs); IDs follow naming convention (property name for value, method name for action, view ID name for forms/panels).binding is not used for data binding; binding is only used on page-scoped variables for component cross-referencing within the same view.render/update references across NamingContainer boundaries use full client ID with leading colon.rendered attribute instead)./WEB-INF/ to prevent direct client access.<h:outputScript>, <h:outputStylesheet>, <h:graphicImage>, or #{resource[]}; when WEBAPP_RESOURCES_DIRECTORY is set to WEB-INF/resources, verify resources are actually in that location.<p:fileDownload> if PrimeFaces).@Named is used with a CDI scope annotation (not @ManagedBean, not missing scope).@ViewScoped is imported from jakarta.faces.view (or javax.faces.view), not from jakarta.enterprise.context or javax.faces.bean.HttpSession (@ViewScoped, @SessionScoped, @ConversationScoped, @FlowScoped, @ClientWindowScoped) implement Serializable.@PostConstruct, not in constructors, field initializers, or getters.UISelectMany backing properties use mutable collections (new ArrayList), not List.of(), Arrays.asList(), or Stream.toList().action methods are used for business logic; actionListener is only used to prepare/gate the action.@RequestScoped for simple non-ajax forms, @ViewScoped for ajax forms/datatables, @ApplicationScoped for shared caches (must be thread-safe).web.xml has FACELETS_SKIP_COMMENTS set to true.web.xml has INTERPRET_EMPTY_STRING_SUBMITTED_VALUES_AS_NULL set to true.WEBAPP_RESOURCES_DIRECTORY: when the resources directory contains composite components (.xhtml files), it MUST be set to WEB-INF/resources to prevent direct client access to composite component source code; for plain assets only (scripts, styles, images, fonts) it's merely a recommendation.*.xhtml only (no legacy *.jsf, *.faces, /faces/*).faces-config.xml version matches pom.xml Faces dependency version..claude/faces/topics/primefaces.md and check its rules..claude/faces/topics/omnifaces.md and check for opportunities to simplify code.For each finding, report:
Group findings by file. If no issues are found, confirm the code follows Faces best practices.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.