review-for-ship — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-for-ship (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run all relevant review agents for this project's tech stack, then invoke rad-code-review as the final gate. This is the comprehensive quality gate — use it before deploying, merging a major feature, or shipping a release.
Announce at start: "Running pre-ship review — dispatching specialist reviewers for your stack, then rad-code-review as final gate..."
Read .claude/stack-profile.local.md from the project root.
If the file does not exist: Tell the user: "No stack profile found. Run /detect-stack first to scan your project and identify which review agents apply. Then come back and run /review-for-ship." Stop here.
If the file exists: Parse the YAML frontmatter. Extract:
project_nameproject_typetechnologies (the list)review_agents (the list of agents with their subagent_type values)plugins.core, plugins.supporting, plugins.pre_ship, plugins.final_gateParse the detected date from the YAML frontmatter. If it is older than 90 days:
"Your stack profile is [N] days old. Dependencies and technologies may have changed. Consider running /detect-stack --update to refresh before review. Continue with current profile?"Wait for user confirmation. If they want to update, stop and suggest /detect-stack --update.
Before dispatching agents, show the user what will run:
## Pre-Ship Review Plan
**Project:** [project_name]
**Type:** [project_type]
**Stack:** [comma-separated technology names]
### Phase 1: Specialist Reviewers (run in parallel)
[For each agent in review_agents:]
- **[agent name]** — [one-line description of what it reviews]
### Phase 2: Final Gate
- **rad-code-review** — AI slop detection, architecture, security, release readiness verdict
This will run [N] specialist agents in parallel, then rad-code-review as the final pass.
Proceed? (This uses context and tokens proportional to the number of agents.)Wait for user confirmation before proceeding. If the user says no or wants to skip certain agents, adjust accordingly.
Launch all specialist review agents in parallel using the Agent tool. For each agent:
subagent_type to the value from the stack profilerun_in_background to true so all agents run concurrentlyReview the project at [current working directory] for [what this agent reviews].
This is a [project_type] project using [technology list].
Scan the full codebase and report findings organized by severity (Critical, Warning, Info).
Be thorough but practical — focus on issues that would cause real problems in production.Only dispatch agents that are listed in the stack profile's review_agents field:
| Agent | subagent_type | Reviews |
|---|---|---|
| Astro Reviewer | rad-astro:astro-reviewer | Astro anti-patterns, performance, hydration, SSR/SSG issues |
| Next.js Reviewer | rad-nextjs:nextjs-reviewer | App Router violations, Server Actions security, IDOR, middleware bypass |
| React Reviewer | rad-react:react-reviewer | Hooks violations, stale closures, performance, accessibility, XSS/IDOR |
| TypeScript Reviewer | rad-typescript:typescript-reviewer | Strict-mode compliance, type safety, API boundaries, AI codegen anti-patterns |
| Fastify Reviewer | rad-fastify:fastify-reviewer | Encapsulation violations, decorator traps, validation, production readiness |
| Zod Reviewer | rad-zod:zod-reviewer | Schema safety, coercion attacks, over-posting, validation boundaries |
| Accessibility Reviewer | rad-a11y:a11y-reviewer | WCAG 2.2 AA compliance, ARIA, keyboard navigation, focus management |
| Chrome Extension Reviewer | rad-chrome-extension:chrome-ext-reviewer | MV3 security, permissions, Chrome Web Store compliance |
| SEO Auditor | rad-seo-optimizer:seo-dominator | Full SEO audit, Core Web Vitals, schema markup, AEO readiness |
| Coolify Reviewer | rad-coolify-orchestrator:coolify-reviewer | Dockerfile, compose, CI/CD, environment variables, security |
| Supabase Reviewer | rad-supabase:supabase-reviewer | Schema, RLS policies, edge functions, migrations, configuration |
After all specialist agents have completed and their results are collected, run rad-code-review as the final gate.
Invoke the rad-code-review skill with these parameters:
production (default) — user can override to mvp or publicrad-code-review provides the generalist layer that complements the specialist reviewers:
rad-code-review's release verdict becomes the ship/no-ship decision:
Once all specialists AND the final gate have reported, compile a unified report.
# Pre-Ship Review Report
**Project:** [name]
**Date:** [today's date]
**Stack:** [technologies]
**Specialist Agents:** [count] run
**Final Gate:** rad-code-review (strictness: [level])
---
## Overall Assessment
**Verdict:** [Ready to Ship / Needs Work / Critical Issues Found]
| Source | Critical | Warning | Info |
|--------|----------|---------|------|
| [Each specialist agent] | [n] | [n] | [n] |
| rad-code-review (final gate) | [n] | [n] | [n] |
| **Total** | **[n]** | **[n]** | **[n]** |
---
## Specialist Findings
### [Agent Name]
**Status:** [Clean / Issues Found]
[If issues found, list organized by severity:]
#### Critical
- [Issue description + file:line + recommended fix]
#### Warnings
- [Issue description + file:line + recommended fix]
#### Info
- [Improvement suggestion]
[Repeat for each specialist agent]
---
## Final Gate: rad-code-review
**Verdict:** [Ship / Conditional / No Ship]
**Strictness:** [mvp / production / public]
### Findings
[rad-code-review findings organized by its standard severity model]
### AI Slop Detection
[Any AI-generated code issues flagged]
### Release Readiness
[Release gate assessment]
---
## Recommended Actions
Priority order for fixing issues before shipping:
1. **[Critical item from any source]** — [why it matters, what to do]
2. **[Critical item]** — [why it matters, what to do]
3. **[Warning item]** — [why it matters, what to do]
...
---
## What's Next?
[Based on overall verdict:]
- **Critical Issues Found:** "Fix the critical issues above, then run /review-for-ship again to verify."
- **Needs Work:** "The warnings above are worth addressing but may not be blockers depending on your timeline."
- **Ready to Ship:** "Your project looks good! No critical issues found across all reviewers and the final gate."After the report, offer:
.ucr/history/ or user-specified path)/detect-stack --update.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.