simplify-code-aedd26 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited simplify-code-aedd26 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Review code for scope, reuse, quality, efficiency, clarity, and altitude issues, then fix them.
Determine what to review:
git diff --cached), use that.git diff, git diff --cached, git diff HEAD) based on the current git state. When the branch is an open pull request, resolve its base with gh pr view --json baseRefName --jq '.baseRefName', run git fetch origin <base-branch>, and diff against origin/<base-branch>...HEAD: a local branch of the same name can sit behind the remote, which puts the merge base before an already-merged pull request and pulls merged work into the scope. If there are no git changes, review the most recently modified files mentioned in the conversation.State the resolved file list before launching the agents: add --name-only to a diff command, or list the files for a file or directory scope.
Launch all six agents below with spawn_agent / wait_agent using inherited model defaults, issuing every call in one batch. Do not issue one and await its result before issuing the rest. Pass the scope from Step 1 to each agent. Every sub-agent's prompt must direct it to treat the shared working tree and its git index as read-only and to reach its findings by reading and reasoning; fixes happen in Step 3. Every sub-agent's prompt must also direct it to search the repository with a tool that skips gitignored files, such as git grep --untracked, and to open or search a gitignored path only when its prompt or a file its prompt directs it to read names it, or when a dependency's installed source is needed to verify a claim, never one holding local configuration or credentials. For an empirical check that verifies a finding, the agent works in a copy of the checkout created at a uniquely named path of its own under $TMPDIR. Refer to that copy by absolute path in every command and join chained steps with &&, so a failed step cannot leave the rest running in the shared checkout. Give that copy its own dependency install rather than reaching the shared tree's install by any route. When its own install is not possible, the check is left unrun and reported as such. Before reporting, the agent deletes that copy, its dependency install included, as a command of its own, and confirms the path no longer exists. A copy it could not delete is named by path in its report. HEAD stays where it is: read other refs with git show <ref>:<path> rather than git checkout or git switch. Direct each agent to write its full findings to a file named for its review followed by a random tag, under $TMPDIR, and to return that path with its report, so a compaction before Step 3 leaves the findings recoverable.
Confine the sub-agent's prompt to what to review, plus the conventions and factual properties that bear on it. Pass a property of the existing code as a fact the sub-agent weighs, such as "the retry loop guards a dependency known to fail intermittently". Leave out any statement that tells the sub-agent what verdict to reach about that property, such as "the duplication here is intentional for readability, judge against that", because it binds the sub-agent to accept the very property the review exists to assess.
Review the changes for code that should not exist:
Trace the callers of any code proposed for deletion and confirm nothing depends on the behavior being removed. Input validation at trust boundaries, error handling that prevents data loss, security controls, accessibility affordances, and anything the request explicitly asked for outrank the four checks above.
For each change:
Review the same changes for hacky patterns:
Review the same changes for efficiency:
Review the same changes for clarity, standards, and balance:
AGENTS.override.md when one is present, otherwise its AGENTS.md — a directory's file governs only the files at or below it, and an override replaces that directory's AGENTS.md rather than adding to it. Flag a violation only when you can quote the exact rule and cite what breaks it: the offending line, or the location where a required element is missing. Name the file the rule came froma ? x : b ? y : ..., nested if/else, or nested switch — flatten with early returns, guard clauses, a lookup table, or an if/else-if cascade), redundant boolean comparisons (e.g., x == true instead of x)Review the same changes for whether each is implemented at the right depth:
Wait for all six agents to complete. Aggregate their findings, reading each agent's findings file at the path it returned when its report is no longer in context. Delete any copy of the checkout an agent named as left behind, and name in the outcome report one that still remains. Then apply each fix directly, skipping only findings that are wrong. When a deletion recommendation and a refactor recommendation land on the same code, the deletion wins. When two agents agree the code should change but propose opposing remedies, prefer the remedy whose measurement reports a result concrete enough to re-run over one resting on reading; a bare claim to have measured ranks no higher than reading. Where neither reports one, apply the narrower remedy and state what the other proposed.
When a recommendation rests on a factual premise that reading the code in question cannot settle — what a platform API returns at runtime, or what a value measures once the system runs — establish that premise before implementing it rather than taking the agent's assertion, using the cheapest check that settles it: a targeted search or count over the source, the implementation behind the premise (the platform's or dependency's own source, or an open-source counterpart of the component checked against the shipped binary as installed on this machine where the two may differ), or a measurement from a surface already running in this session. When the premise is that a guard, check, or rule is redundant and the evidence is a comparison of runs with and without it, those runs must include the inputs it exists for, built on purpose where the condition it protects is hardest to meet. Runs that never reach those inputs leave the premise unsettled. When nothing available settles it, skip the finding and name the unverified premise as its reason. Reading alone cannot catch a false premise: the recommendation is coherent, the change lands cleanly, and the checks pass, leaving a change that cannot do what it was made to do.
A finding that would revise an interface or shape the user already approved is not a false positive. Output its technical detail as text, then use request_user_input to let the user decide, naming what the revision would change and what reversing the earlier decision costs. Place the genuinely best option first and append (Recommended) to its label, judging "best" on technical merit alone, independent of how closely it conforms to the earlier decision. When merit cannot settle it, say so instead of forcing a pick. Present the consultation option in place of Note for later, keeping the question at three options:
$consult-claude skill for the soundest shape on technical merit alone, independent of the earlier decision, carrying back what changing it costs. Then apply, keep, or note the finding with that answer in handA freeform answer asking to record the finding without changing the code runs the $note-improvement skill to capture it.
Once this round's fixes have landed, including any resolved at a gate, make one pass over the agents' findings: any whose verdict depended on code the fixes changed, moved, added, or deleted gets decided again against the current tree, keeping resolutions the user already chose.
Report the outcome as a table, one row per finding, keeping every cell to a single line:
| File | Finding | Outcome |
|---|
Where Outcome is one of:
Where one criterion recurs across many sites, or many sites fall within one file, a single row may cover that group. Name the directory or file cluster it spans and the count. Every Skipped and Escalated finding keeps its own row with its reason, since those are the rows a reader acts on.
Keep the report to the table. Add prose only where an escalation's resolution changed what the other fixes look like. When the table would be empty, report one line stating the code was already clean instead.
Then call update_plan to mark this step completed and continue with the next step of the active workflow.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.