post-code-review-to-pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited post-code-review-to-pr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When running a PR code review, follow the process outlined here.
which ghwhich jqIf gh is not found, inform the user it must be installed and configured; if jq is not found, inform the user it must be installed. In either case, immediately stop.
git branch --show-currentgit symbolic-ref --short refs/remotes/origin/HEADgh pr diff --name-onlyIf changed files is empty or gh pr view --json number,url fails, inform the user no reviewable PR exists for the current branch and stop.
Invoke the /code-review skill to perform the full code review. Pass along any user-provided focus areas or context from the original arguments. After /code-review completes, proceed immediately to Step 3 — do not stop here.
Ask the user whether they'd like to post the review to the PR on GitHub using AskUserQuestion with options "Yes, post the review to GitHub" and "No, just the local review". If the user declines, proceed to Step 5.
If the user accepts:
${CLAUDE_SKILL_DIR}/scripts/pr-metadata.sh, which outputs JSON with owner_repo, pr_number, head_sha, pr_author_login, and current_user_login.Because the review body will be publicly visible on the PR, run a clarity pass on the draft before posting.
/tmp/post-code-review-to-pr-draft.md) using the Write tool.han-core:junior-developer agent in artifact-review mode with the prompt: "You are reviewing the text of a code review that is about to be posted publicly on a GitHub pull request. The review is at {draft_path}. Do not re-review the code — review the review. Flag findings whose wording is unclear, severity is mis-assigned (CRIT used where WARN would be accurate, or vice versa), language is accusatory or blaming rather than evidence-based, or file_path:line_number references are missing or invalid. Return a short list of specific edits with before/after text; return an empty list if the review reads well as-is."${CLAUDE_SKILL_DIR}/scripts/create-review-tempfile.sh. Write the final, edited review body to that path using the Write tool (not Bash).pr_author_login matches current_user_login (self-authored PR), post as a PR comment (GitHub rejects formal reviews from PR authors) by running ${CLAUDE_SKILL_DIR}/scripts/post-pr-comment.sh {pr_number} {temp_file_path}. If they differ, determine event type (REQUEST_CHANGES if any CRIT or WARN findings exist, COMMENT if only SUGG) and post as a formal review by running ${CLAUDE_SKILL_DIR}/scripts/post-pr-review.sh {owner/repo} {pr_number} {head_sha} {event_type} {temp_file_path}.If any Critical or Warning issues were identified, ask the user using AskUserQuestion — "Would you like me to create a plan to fix the identified issues?" with options "Yes, create a fix plan" and "No, just the review". If yes, enter plan mode and create a detailed implementation plan listing each Critical and Warning item by task ID, with specific code changes, file paths, and line numbers, ordered by priority (Critical first). If no Critical or Warning issues were found, the review is complete — suggestions alone do not warrant a fix plan.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.