a5c-ai/git-forensics-scanner
library/specializations/security-compliance/skills/git-forensics-scanner/SKILL.md
Git diff forensics for surfacing and classifying code changes for trojan detection
$ install --global
skillsauthnpx skillsauth add a5c-ai/babysitter git-forensics-scannerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 2, 2026, 2:03 PM57.6s2 files scanned
SKILL.md
- name:
- git-forensics-scanner
- description:
- Git diff forensics for surfacing and classifying code changes for trojan detection
Git Forensics Scanner
Surfaces and classifies all code changes in a repository using git diff analysis, providing structured change sets for downstream semantic analysis.
Purpose
The first phase of nation-state trojan detection: identify exactly what changed, how much changed, and classify each change by risk level. Small diffs in critical code paths are flagged as highest-risk since business-logic trojans typically modify 1-5 lines.
Capabilities
Change Set Extraction
- Unstaged changes (
git diff) - Staged changes (
git diff --cached) - Commit range diffs (
git diff <base>..<head>) - Branch diffs (
git diff <base>...<head>) - Per-file patch extraction with full hunk context
Change Classification
- code — Logic, algorithms, formulas, control flow
- config — Constants, parameters, thresholds, defaults
- data-model — Schemas, types, model properties, ORM mappings
- cosmetic — Formatting, comments, whitespace, rounding wrappers
Risk Triage
- Files with 1-5 line changes in prediction/financial/auth code → HIGH RISK
- Single-character operator changes → CRITICAL RISK
- Comment-only changes accompanying code changes → CAMOUFLAGE RISK
Input Schema
{
"type": "object",
"required": ["projectRoot"],
"properties": {
"projectRoot": {
"type": "string",
"description": "Absolute path to the git repository"
},
"scanMode": {
"type": "string",
"enum": ["uncommitted", "commit-range", "branch-diff"],
"default": "uncommitted"
},
"baseRef": {
"type": "string",
"description": "Base git reference (for commit-range/branch-diff)"
},
"headRef": {
"type": "string",
"description": "Head git reference (for commit-range/branch-diff)"
},
"targetPaths": {
"type": "array",
"items": { "type": "string" },
"description": "Limit scan to specific paths"
}
}
}
Output Schema
{
"type": "object",
"required": ["totalFiles", "files"],
"properties": {
"totalFiles": { "type": "number" },
"totalInsertions": { "type": "number" },
"totalDeletions": { "type": "number" },
"files": {
"type": "array",
"items": {
"type": "object",
"properties": {
"path": { "type": "string" },
"insertions": { "type": "number" },
"deletions": { "type": "number" },
"hunks": { "type": "number" },
"classification": { "type": "string" },
"rawDiff": { "type": "string" },
"riskLevel": { "type": "string" }
}
}
}
}
}
Usage Example
skill: {
name: 'git-forensics-scanner',
context: {
projectRoot: '/path/to/project',
scanMode: 'uncommitted'
}
}
Process Files
nation-state-trojan-detection.js— Phase 1: Git Forensics task
Related Skills
a5c-ai/model-card-generator
development
VerifiedTrustedCommunity
Model documentation skill for generating model cards following Google's model card framework.
680SKILL.mdUpdated Apr 28, 2026
a5c-ai/mlflow-experiment-tracker
development
VerifiedTrustedCommunity
MLflow integration skill for experiment tracking, model registry, and artifact management. Enables LLMs to log experiments, compare runs, manage model lifecycle, and retrieve artifacts through the MLflow API.
680SKILL.mdUpdated Apr 28, 2026
a5c-ai/lime-explainer
data-ai
VerifiedTrustedCommunity
LIME-based local explanation skill for individual predictions across tabular, text, and image data.
680SKILL.mdUpdated Apr 28, 2026
a5c-ai/kubeflow-pipeline-executor
devops
VerifiedTrustedCommunity
Kubeflow Pipelines skill for ML workflow orchestration, component management, and Kubernetes-native ML.
680SKILL.mdUpdated Apr 28, 2026