compose-preview-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited compose-preview-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Workflows for reviewing pull requests that touch Compose UI, authoring agent-opened PRs that include preview screenshots, and wiring CI to post before/after diffs automatically.
This skill assumes the compose-preview skill is installed — it owns the renderer, CLI, and Gradle plugin. Check first with compose-preview --version; if it's missing, ask the user to run the bootstrap installer (which covers both skills):
curl -fsSL https://raw.githubusercontent.com/yschimke/compose-ai-tools/main/scripts/install.sh \
| bashThis skill is maintained at github.com/yschimke/skills under skills/compose-preview-review/. To check for updates, compare the installed copy against main (e.g. git ls-remote https://github.com/yschimke/skills HEAD). The CLI, renderer, and GitHub Actions referenced below ship from github.com/yschimke/compose-ai-tools.
Pick the workflow that matches the task:
| Task | Read |
|---|---|
| Review a PR locally that touches UI | references/agent-pr.md § Reviewing a PR |
| Author an agent-opened PR that touches UI | references/agent-pr.md § Authoring an Agent PR |
Wire compose-preview/main baselines + PR-comment CI for a project (or migrate from the legacy four-action setup) | references/ci-previews.md |
| Render previews on base and head and diff them | references/agent-pr.md § Render base and head locally |
sticky <!-- preview-diff --> comment is already on the PR, read it and cite it instead of re-rendering. See references/agent-pr.md § Optional: integrate with apply CI in comment mode.
BASE=$(gh pr view <N> --json baseRefName -q .baseRefName)
git worktree add ../_pr_base "origin/$BASE"
(cd ../_pr_base && compose-preview show --json) > base.json
compose-preview show --json > head.json
git worktree remove ../_pr_baseid + sha256. Bucket into changed / new / removed.context the human reviewer will lack.
only with explicit consent — see references/agent-pr.md § Uploading images.
| Path | When to read |
|---|---|
| references/agent-pr.md | Full PR review + agent PR authoring guidance: comment structure, image hosting choices, things to flag, integration with the unified apply CI action when present. |
| references/agent-audits.md | Agent audit recipes and data-product documentation clusters: accessibility, localisation, Wear clipping, resources, theme, traces, and failure triage. |
| references/ci-previews.md | compose-preview/main baselines branch + PR-comment GitHub Actions: unified apply workflow YAML, action inputs, branch durability, and migration from the legacy preview-baselines / preview-comment / a11y-report / notification-previews actions. |
| references/mcp-review.md | Driving a PR review through the MCP server (two-workspace base+head flow, push notifications, edit-on-top iteration). |
renderer itself: CLI, Gradle plugin, @Preview design patterns, capture modes (animations, scrolling), accessibility checks.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.