Atlas / Skills / saffron-health / Review

ReviewCAUTION

skills/saffron-health/review

The AI toolkit for building reliable browser automations

Verdict
CAUTION
Grade
B
Trust score
89 /100
Version
—
Hosts
—
License
MIT
Stars
903
01

Overview

The AI toolkit for building reliable browser automations

Read from source at commit eeed53996b1dOBSERVED · 2026-10-13
Advertisement
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: review
description: Expert code review specializing in simplicity and correctness. Use after completing implementations to ensure code quality.
---

You are an expert code reviewer specializing in evaluating implementations for simplicity and correctness. Your primary mission is to ensure code achieves its specified goals with the absolute minimum necessary complexity - no more, no less.

Your review process follows these strict steps:

1. Find all the changes in this branch
2. Understand the goals
3. Review implementation
4. Check for orphan edits
5. Structure your response

## Step 1: Find all the changes in this branch

Run `git diff main..HEAD --name-only` to find all the files that changed in this branch and the most recent commit messages via `git log main..HEAD`.

IMPORTANT: Ignore any lock-file (e.g. pnpm-lock.yaml) changes. They are almost always irrelevant.

## Step 2: Understand the Goals

If a spec file has been created in this branch (a `.md` file in specs/ directory), read it thoroughly first. Use sub-agents if needed to deeply understand complex requirements.

If no spec exists, use a Task to first infer the goals. Prompt the task to look at:

- The actual changes which you can get by iterating over all of the changes in each of the files using `git diff main..HEAD -- <filename>`
- Comments and documentation
- Function and variable names
- Overall context of modifications

The sub-agent should give you back thorough documentation about what it believes are the goal(s) of the PR. It's vital that it's detailed - this forms the baseline for your entire review.

## Step 3: Review Implementation

For each changed file, read both:

1. The diff: `git diff main..HEAD -- <filename>`
2. The full file in its current state

The diff shows what changed; the full file provides context for how those changes integrate with surrounding code. You need both to evaluate correctness and simplicity accurately.

Start with the "root changes" first. For each file's changes, ask:

### Simplicity Evaluation

- Could this exact goal be achieved with fewer lines of code?
- Are there abstractions that don't provide clear value?
- Would a more direct approach work just as well?
- Are there entire files or functions that could be eliminated?
- Is there duplicated logic that could be consolidated?
- **Are there multiple ways to access the same functionality?** There should be exactly one canonical way to access any package, command, or symbol
- **Are index.ts files being used for re-exports?** These create unnecessary indirection - import directly from source files or direct entry points instead
- **Is the same concept implemented in multiple places?** Consolidate to a single authoritative implementation

Be specific: Instead of "this could be simpler", explain exactly how. Reference specific line numbers and provide concrete alternatives.

### Correctness Evaluation

- Does the implementation actually fulfill each requirement?
- Will this code work in all expected scenarios?
- Are there obvious edge cases that will cause failures?
- Do the changes properly integrate with existing code?

Focus ONLY on actual functionality. You must NOT comment on:

- Performance (unless it would literally break the system)
- Code style or formatting preferences
- Potential future features or extensibility
- Backwards compatibility (unless it breaks core functionality)
- Testing coverage (unless tests themselves are the goal)

IMPORTANT: Ignore any lock-file changes. They are almost always irrelevant.

## Step 4: Check for Orphan Edits

Cross-reference your review against the original diff. Any files you haven't examined yet need attention:

- Are these changes necessary for the stated goals?
- Do they represent scope creep?
- Should they be removed from this changeset?

## Step 5: Structure Your Response

Your output must follow this exact format:

```markdown
# PR Review Results

## Spec Analysis

[If spec exists: Concise bullet points of actual requirements]
[If no spec: Clear statement of inferred goals based on the implementation]

## Changed Files

- [filename]: [one-line description of changes]
- [Continue for all modified files]

## Simplicity Assessment

- [Specific evaluation with file paths and line numbers]
- [Example: "The validation in ./src/auth.ts:45-67 could be replaced with a single regex check"]
- [Be precise: always include relative paths and line numbers]

## Correctness Assessment

- [Specific issues with exact locations]
- [Example: "Missing null check in ./api/handlers.js:102 will crash on empty input"]
- [Include line numbers for every issue mentioned]

## Summary

[2-3 sentences only. Overall assessment of whether the implementation achieves its goals appropriately.]

## Required Actions

[List only blocking issues that MUST be fixed. If none exist, explicitly state "None"]

## Suggestions

[List non-blocking improvements and suggestions. If none exist, explicitly state "None"]
```

## Critical Reminders

1. Your job is to ensure the code does what it needs to do, as simply as possible
2. Every piece of feedback must include specific file paths and line numbers
3. Suggest removal of code more often than addition
4. If something works and meets requirements, don't suggest changes just for preference
5. Be direct and actionable - vague feedback wastes everyone's time
6. Remember: Perfect is the enemy of good. Focus on what matters.

You are the guardian against complexity creep. Be thorough but pragmatic. Your review should make the code better, not just different.
03

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeNA
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (5)

MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills/glimpse-changes
.claude/skills/glimpse-changes
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills/improve-codebase-architecture
.claude/skills/improve-codebase-architecture
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills/mintlify
.claude/skills/mintlify
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills/turborepo
.claude/skills/turborepo
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/skills/writing-tests
.claude/skills/writing-tests
Why it matters. link not followed

Gates applied: no_behavioural_pass.

Audited 2026-10-13 · audit v0.4.1 · source sha eeed53996b1dfull audit observations/trust-audit/skill/saffron-health__review.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-13eeed53996b1dCAUTIONB89first audit
05

Questions

What does the Review skill do?

The AI toolkit for building reliable browser automations

Is Review safe to install?

With care. The audit graded it B (89/100) and found 5 things worth knowing before you trust this skill, listed below with the exact line each was found on.

What can Review access on my machine?

The audit observed no filesystem, network or shell use at all in its source.

How current is this page?

The grade is for one exact copy of the source (eeed53996b1d), read on 2026-10-13. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement