best-practice — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited best-practice (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Script path fallback: qq scripts are invoked as bare commands (e.g.unity-test.sh). If "command not found", use${CLAUDE_PLUGIN_ROOT}/bin/<command>instead.
Respond in the user's preferred language (detect from their recent messages, or fall back to the language setting in CLAUDE.md).
Quick best-practice check for Unity C# code. Run this right after editing code — it scans for anti-patterns, performance traps, and runtime safety issues against 18 rules.
Arguments: $ARGUMENTS
Intelligently determine what to check:
git diff --name-only HEAD -- '*.cs'Do NOT review the entire codebase by default. Focus on what just changed.
If qq-policy-check.sh is available, run it first against the selected scope:
qq-policy-check.sh --json <files...>Treat those results as the first-pass findings. Do not ask the model to rediscover the same high-confidence issues from scratch. Use the model for:
Assets/Editor/, inside #if UNITY_EDITOR blocks) may use these[SerializeField]new List, new Dictionary, string + or $"" interpolation, .ToString(), LINQ queries (.Where, .Select, .ToList), lambda closuresCompareTag() (allocation-free)+= event subscription must have a matching -= unsubscriptionGetComponent<T>() and the result is used without null check, the class should have [RequireComponent(typeof(T))]using directives do not violate the project's established dependency direction[SerializeField] private for Inspector-assigned fieldsAdd your project's coding standards and anti-patterns here. Example:
Group output by severity:
## 🔴 Critical (High severity — must fix)
- [file:line] Issue description → suggested fix
## 🟠 Moderate (Medium severity — should fix)
- [file:line] Issue description → suggested fix
## 🟡 Suggestions (Notice — nice to fix)
- [file:line] Issue description → suggested fix
## ✅ Code Quality Highlights
- Brief list of things done wellqq-policy-check.sh --json if availableAfter the check completes, recommend the next step:
/qq:test to verify, or /qq:claude-code-review for a deeper review?"/qq:best-practice to confirm, or proceed to /qq:test?"/qq:test anyway, or fix first?"`--auto` mode: skip asking, take the strictest path: → auto-fix all issues → re-run self until clean → /qq:claude-code-review --auto
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.