pull-feedback — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pull-feedback (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pulls review feedback on a PR the user authored into a working doc with per-thread triage slots. The point is rigor: every unresolved thread gets a tentative verdict (valid / invalid / nice-to-have / needs-clarification) with reasoning and a plan, so the user can work through feedback deliberately instead of rubber-stamping.
Announce: "Using git:pull-feedback to pull and triage feedback on PR #N."
./fetch.sh [ref]ref accepts a bare number, #N, owner/repo#N, a PR URL, or nothing (auto-detects from current branch). The script writes a skeleton doc to .scratch/pr-reviews/<N>/threads.md with _pending triage_ placeholders and prints counts on stdout. Use this output location — don't invent your own filename.
Add a ## Summary section (1-2 sentences on what the PR does + state of the review) only if you don't already know the PR. If the user has been discussing it in conversation or the branch name tells you, skip — guessing wastes tokens and risks confabulation.
Each thread has a unique <!-- thread: N --> anchor. Use targeted Edit calls to fill three slots per thread:
Keep the (tentative) label. It's the shallow-pass signal; it invites deep-dive on anything non-obvious.
When the user asks to dig into a specific thread ("verify the race condition claim", "dig into thread 3"):
**Verdict (tentative):** → **Verdict:**Shallow pass catches obvious cases (typos, renames, style). Deep-dive is where the hard judgment lives — reserve it for threads with real technical substance.
For any Invalid, apply superpowers:receiving-code-review: verify the reviewer's claim is actually wrong (don't just disagree because fixing is annoying), acknowledge the concern even when disagreeing, and plan a reply that explains the reasoning. That skill was written for agent reviews; the core rigor applies equally to humans.
Summarize counts and offer a next step:
7 threads triaged: 4 valid, 2 invalid, 1 nit. Doc at .scratch/pr-reviews/603/threads.md. Walk through them, or dig deeper on specific ones?Then stop. Addressing threads, making code changes, and replying are normal work from there — not this skill's job.
This skill is about review threads, not PR health. Do NOT drift into:
If the user asks "catch me up on my PR", they mean the review feedback. Other PR state belongs to other tools (gh pr view, gh pr checks, git:pull-request).
Reviewer scoping: If the user asks specifically about one reviewer ("what did alice say?"), scope the doc to that reviewer's threads. Other reviewers' threads can be omitted or deferred — don't force all-threads mode.
git:inboxgit:pull-requestpr-review-toolkit:review-pr or code-review:code-review| Action | Command |
|---|---|
| Fetch for current branch's PR | ./fetch.sh |
| Fetch for specific PR | ./fetch.sh 123 or ./fetch.sh owner/repo#123 |
| Deep-dive on thread N | Read the file, update verdict + reasoning via Edit |
| Run internal tests | ./tests/run-tests.sh |
(tentative) marker isn't decoration — keep it until you've read the code for that thread.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.