compose-preview-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited compose-preview-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Workflows for reviewing pull requests that touch Compose UI and authoring agent-opened PRs that include preview screenshots.
Setting the CI up is a separate job with a separate skill — compose-preview-ci owns baselines branches, the apply action, and the fork-safe two-stage split. This skill is about reading what that CI produces (and rendering by hand when it isn't there).
This skill assumes the compose-preview skill is installed — it owns the renderer, CLI, and Gradle plugin. Hosted catalog and UI Builder guidelines reviews use its checklist without requiring a local CLI or Gradle checkout. For local rendering workflows, check first with compose-preview --version; if it's missing, follow its setup reference (usually one command: bash ~/.agents/skills/compose-preview/scripts/compose-preview --version).
This skill is maintained at github.com/yschimke/skills under skills/compose-preview-review/. To update, see setup.md § Update. The CLI, renderer, and GitHub Actions referenced below ship from github.com/yschimke/compose-ai-tools.
Pick the workflow that matches the task:
| Task | Read |
|---|---|
| Review previews or a catalog render against Android design guidelines | Catalog guidelines checklist from the required compose-preview skill (read its installed reference first) |
| Review a PR locally that touches UI | references/agent-pr.md § Reviewing a PR |
| Review or author from a CI agent session (a mention-triggered agent on an Actions runner) | references/ci-agent-sessions.md |
| Author an agent-opened PR that touches UI | references/agent-pr.md § Authoring an Agent PR |
| Triage a flaky or unstable preview (time, randomness, animation, network images) | references/stability.md |
| Report, accept, verify, and close a design-parity difference | references/design-parity-lifecycle.md |
Wire compose-preview/main baselines + PR-comment CI for a project (or migrate from the legacy four-action setup) | compose-preview-ci skill |
| Render previews on base and head and diff them | references/agent-pr.md § Render base and head locally |
.github/workflows/ for compose-preview.yml (the apply action), legacy preview actions, and design-parity/design-artifacts pipelines — see references/ci-agent-sessions.md § Discover the repo's preview CI. If a sticky <!-- preview-diff --> comment is already on the PR, read it and cite it instead of re-rendering. See references/agent-pr.md § Optional: integrate with apply CI in comment mode.
BASE=$(gh pr view <N> --json baseRefName -q .baseRefName)
git worktree add ../_pr_base "origin/$BASE"
(cd ../_pr_base && compose-preview show --json) > base.json
compose-preview show --json > head.json
git worktree remove ../_pr_baseid + sha256. Bucket into changed / new / removed.context the human reviewer will lack.
For a design-guidelines review, also follow the catalog guidelines checklist. Reuse the PR's <!-- guidelines-report --> when it matches the head and applicable rules. Report stale, pending or unchecked coverage rather than treating an empty findings list as passed.
only with explicit consent — see references/agent-pr.md § Uploading images.
| Path | When to read |
|---|---|
| Catalog guidelines checklist | Keyless MCP review, published guideline results and CLI fallback; surface selection, pictures, measured evidence and coverage. |
| references/agent-pr.md | Full PR review + agent PR authoring guidance: comment structure, image hosting choices, things to flag, integration with the unified apply CI action when present. |
| references/ci-agent-sessions.md | Running this skill inside a mention-triggered CI agent session: Gradle-only rendering, commit-SHA-pinned image embedding, discovering and reusing the repo's existing preview-diff CI. |
| references/stability.md | Flaky / unstable previews: detection (render twice, CI symptoms), common causes (clock, randomness, animations, network images, locale), fixes, and how to review a suspect diff. |
| references/agent-audits.md | Agent audit recipes and data-product documentation clusters: accessibility, localisation, Wear clipping, resources, theme, traces, and failure triage. |
| references/mcp-review.md | Driving a PR review through the MCP server (two-workspace base+head flow, push notifications, edit-on-top iteration). |
| references/design-parity-lifecycle.md | Catalog-owner workflow for reporting, triage, scoped acceptance, status review, verification, and safe atomic closure. |
renderer itself: CLI, Gradle plugin, @Preview design patterns, capture modes (animations, scrolling), accessibility checks.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.