code-overview — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited code-overview (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
which gitwhich ghfind . -maxdepth 1 -name "CLAUDE.md" -type ffind . -maxdepth 3 -name "project-discovery.md" -type fRead these before doing anything. They constrain every step below.
han-core:codebase-explorer agents gather the surrounding code and context the synthesis draws on — they do not write the overview. After the draft is written, han-core:adversarial-validator re-reads the code to challenge the draft's claims for accuracy, and han-core:information-architect and han-core:junior-developer review it for progressive disclosure and readability; the skill applies their recommendations. The skill itself produces the grouping, the charts, the orientation, and the final rewrite.code-review's job; this skill only helps the operator understand the PR before they review it. Crossing this line collapses the boundary between the two skills.project-documentation's job; this skill is an understand-now orientation aid.Bind `$size`. If the user passed small, medium, or large as the first positional argument, bind $size to it. Anything else is part of the target, not a size; bind $size to the literal none provided.
Note tool availability. Read git installed and gh installed from Project Context. If git installed is empty, git is unavailable — see the degraded paths below.
Resolve the target and mode by this fixed precedence, so an ambiguous string never silently selects the wrong mode:
#82, https://github.com/owner/repo/pull/82) → PR mode against that pull request. Requires gh; if gh installed is empty, tell the user gh is needed to read a named pull request and offer code mode against a local target instead.Handle the unresolvable and empty cases (state the problem plainly and stop; never guess):
Resolve project context. If CLAUDE.md is present, read its ## Project Discovery section for conventions; fall back to project-discovery.md. These resolve language and framework questions so the explorers infer less. If neither exists, note that surrounding-code inference applies and pass that into the briefs.
Classify the target's size. Default to small; escalate only on a clear signal, and stay at the smaller band when a signal is borderline.
Apply the size override. If $size is not none provided, use it as the band and skip the signal-based classification; a conversational override ("give me a large overview") is equivalent.
Announce the chosen mode and size in one line before dispatching any exploration — for example, Code mode, size medium: directory \src/auth/\ spanning the session and token subsystems. State tool degradation in the same line when it applies (git unavailable — code mode only). Proceed without a blocking confirmation; this skill is read-only and re-runnable, so a gate here would gate a reversible operation. Honor any adjustment the user makes.
Code mode. Read the target file, directory, or symbol and enough of its immediate neighbors to know its boundary — what it imports and what imports it.
PR mode. Gather the change set:
git symbolic-ref refs/remotes/origin/HEAD or fall back to main/master), then capture git diff {default-branch}...HEAD for committed work and git diff plus git diff --cached for uncommitted work. Run each diff as its own Bash command so large diffs stream incrementally. Also capture git log {default-branch}..HEAD --pretty=format:%B for the change's intent. When gh is available, also run gh pr view --json title,body,comments (no ref — resolves the PR for the current branch) so the change's stated intent and any screenshots are in scope; if no PR exists for the branch, skip this without failing.gh pr view {ref} --json title,body,comments for intent and screenshots, and gh pr diff {ref} for the change set. If the pull request cannot be reached (it does not exist, or access is unavailable), say so and offer code mode against a local target instead.Capture screenshots. When a PR body or a comment contains embedded images — Markdown  or <img src="url">, typically GitHub-hosted (user-attachments, githubusercontent.com) — record each image's URL together with the nearby caption or heading that says what it shows. These let the overview show a visual next to the text that describes it, so the reader does not have to switch back to the PR. If the PR has no images, capture nothing here.
Identify the set of files the change touches; that set scopes the exploration in Step 4.
Dispatch han-core:codebase-explorer agents to discover the surrounding code and context — the evidence of why the code exists (the problem it solves or goal it serves), plus entry points, directly-related context, uses, and the main process flow — that the synthesis draws on. Scale the count to size, and launch every agent in a single message so they run concurrently:
Each brief must contain: the resolved target (and, in PR mode, the changed-file set and the captured intent from Step 3); the project-context conventions from Step 1, or a note that surrounding-code inference applies; and the instruction to report the evidence of why the code exists — the problem it solves or goal it serves, drawn from commit messages, PR/issue intent, code comments, naming, and tests — alongside entry points, directly-related context, uses, and the main flow, as concrete, file-grounded findings. Instruct each explorer to report what it found, not to assess quality — this skill raises no findings — and, where the why is not stated anywhere in the evidence, to say so rather than infer one.
Wait for the whole wave to return before synthesizing. If the target proves too large to cover fully at the chosen size, the explorers cover the highest-signal areas; carry that into the coverage note in Step 5.
Read references/overview-template.md and render the structure for the resolved mode, drawing on the explorers' findings and the input from Step 3. The skill writes the overview; the explorers' raw findings are not pasted in.
Open the document with a title and a short intro paragraph naming what is being examined — the file, directory, symbol, pull request, or branch, and the part of the system it belongs to. Do NOT emit a Mode:, Generated:, or bare Target: metadata block; that metadata does not help the reader. Never state PR statistics — lines changed, files changed, additions/deletions, or commit counts — anywhere in the document; they go stale the moment the PR changes and add no understanding. Fold anything worth keeping into the intro sentence.
Lead with the why, and let everything else flow from it. The first section after the intro answers why this code (or this change) exists — the real problem it solves or the goal it accomplishes for the business or a user, then why it works the way it does and why it is the current solution to that need. Tell the why as a solution to a need, not as technical mechanics. Then frame every section that follows as serving that why: the flow shows how the code delivers on it, the context shows what it depends on to meet the need, the handoff shows where to start working on it. When the why is not recoverable from the code and its intent (commit messages, PR/issue text, comments, naming, tests), state what the code demonstrably does toward a goal and mark the inferred why as inferred — never invent a business rationale the evidence does not support.
Code mode renders, in order: the title and intro paragraph; a coverage note only if coverage was partial; Why it exists (the problem the code solves or goal it serves, then briefly what it is and why it works the way it does — all flowing from the why); Main flow (a Mermaid chart with a one-line scope label, read as how the code delivers on the why); Context and uses (context and uses kept distinguishable, framed as what it depends on to meet the need and where that need is served from); Where to start (the concrete entry points the operator opens first).
PR mode renders, in order: the same title and intro paragraph; the same conditional coverage note; Why this change exists (the problem the change solves or goal it advances, then briefly the bottom line of what it does); Changes by intent (grouped by the reader-visible outcome each group delivers — the why each group serves — not by file, layer, or author motivation; a single logical change is one narrative with no grouping header); How the change flows (a Mermaid chart with a scope label, placed after the grouped changes BECAUSE the reviewer must know what changed before that chart is meaningful); What to watch when reviewing (navigational only — where the change is hardest to follow and why; never a quality or risk judgment).
Place any captured screenshots inline next to the text they illustrate — embedded as  directly under the Changes-by-intent item or the flow step they depict, BECAUSE a visual next to its description spares the reader a trip back to the PR. Keep the image URL exactly as captured. Omit screenshots entirely when the PR had none; never invent or placeholder an image.
Apply the per-section detail rule from the template: minimal technical detail in the why, flow, and context sections — the why told as a problem solved or goal met, not technical mechanics; concrete named entry points in the handoff section. Give every chart a scope label. When coverage is partial, place the coverage note immediately after the intro paragraph so the reader calibrates before investing in the charts.
Write the rendered overview to a scratch file outside the repository — for example ${TMPDIR:-/tmp}/code-overview-{short-target-slug}.md. Never write it into the repository's documentation tree; this overview is ephemeral. The next step reviews and rewrites this file in place.
Dispatch three agents in parallel — one Agent call each, in a single message — over the draft overview. One challenges whether the overview is true to the code; two review whether it reads well. Pass each the scratch-file path, and pass the validator the resolved target (and, in PR mode, the changed-file set) so it knows what to re-read.
Tell the information-architect and junior-developer explicitly: review the overview document for readability only — do not review the underlying code, and do not raise findings about it. The validator is the one agent that reads the code, and it does so only to check the description's accuracy, never to judge quality. BECAUSE this skill makes no quality judgment about the code; the validation pass guards truth, the readability pass guards clarity, and neither crosses into evaluating the work itself. The agents return recommendations; they do not edit the file.
Apply the recommendations directly, rewriting the scratch file in place. Accuracy corrections take precedence: fix or cut every claim the validator disproved before applying any readability change — a sentence that reads beautifully but describes a flow the code does not follow must still be corrected or removed. Then apply the structure and phrasing recommendations on the corrected text. Keep the spec-content discipline: the result is still an orientation aid with no quality findings, led by the why with everything flowing from it, minimal technical detail in the why/flow/context sections, and concrete entry points in the handoff section. When the readability agents conflict, prefer the change that makes the document easier for an unfamiliar reader to act on. If validation removed so much that coverage is now meaningfully partial, add or update the coverage note accordingly.
Present to the user in a short message: the scratch-file path, the mode and size used (and why), and any coverage gap the overview noted. Do not paste the whole overview into the conversation; point the user at the file, where the Mermaid charts render.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.