code-review-checklist — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited code-review-checklist (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A reviewer's running checklist. Walk the categories, flag what's missing, and tag findings by severity.
// Weak — raw user text, no structure or guardrails
const reply = await model.complete(userText);
// Strong — explicit role, cleaned input, enforced output shape
const reply = await model.complete({
role: "You parse invoices into JSON and nothing else.",
input: clean(userText),
schema: InvoiceSchema,
});// Unexplained literal
if (state === 2) { /* ... */ }
// Named instead
if (state === OrderState.SHIPPED) { /* ... */ }
// Arrow-shaped nesting
if (a) { if (b) { if (c) { /* ... */ } } }
// Flattened with guards
if (!a) return;
if (!b) return;
if (!c) return;
// ...real work
// One enormous function -> several focused ones
// Escape-hatch typing -> precise types
const payload: any = fetchIt(); // avoid
const payload: Invoice = fetchIt(); // prefer[blocker] Must fix before merge — e.g. command injection in this handler
[suggest] Worth improving — memoize this derived value
[nit] Minor polish — this could be const
[?] Genuine question — what's the behavior when the list is empty?Use the same prefixes consistently so the author can scan severity at a glance and address blockers first.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.