paulnsorensen/diff
claude/skills/diff/SKILL.md
Quick pre-commit smoke test of staged or unstaged changes. Scans for blockers (secrets, debug statements, commented code, silent failures) and warnings (oversized functions/files, deep nesting, domain leakage). Use when asked to review staged changes, run a pre-commit check, or when the /diff command is invoked.
$ install --global
skillsauthnpx skillsauth add paulnsorensen/dotfiles diffInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 27, 2026, 9:57 AM76.1s1 file scanned
SKILL.md
- name:
- diff
- model:
- haiku
- context:
- fork
- allowed-tools:
- Bash(git diff:*), Bash(git status:*), Bash(git log:*), Bash(rg:*), Bash(sg:*), Bash(delta), Read
- description:
- >
diff
Quick smoke test. Catch the obvious, skip the nitpicks.
Protocol
1. Get the Diff
# Default: staged changes
git diff --staged
# If no staged changes, show unstaged
git diff
# If a ref is provided, diff against it
git diff {ref}
If there are no changes at all, say so and stop.
Tool Selection
sg— structural checks: empty catch blocks, missing error handling, functions missing return typesrg— text patterns: TODO/FIXME, console.log, hardcoded secrets, debug statements, commented codeRead— context: when a pattern match needs surrounding code to judge if it's a real problem
Default to rg. Reach for sg when the question is about code shape, not text.
2. Scan for Red Flags
Check the diff for these categories only — in priority order:
Blockers (must fix before commit):
- Hardcoded secrets, API keys, tokens, passwords
console.log/print/fmt.Printlndebug statements left in- Commented-out code blocks (delete or keep, don't commit commented code)
- TODO/FIXME/HACK without a ticket reference
- Empty catch/except blocks (silent failures)
- Missing error handling on new I/O operations (file, network, DB)
Warnings (worth a second look):
- New dependencies added (pairs with block-install hook)
- Functions exceeding 40 lines
- Files exceeding 300 lines
- Nesting deeper than 3 levels
- Core model/domain files importing infrastructure
3. Report
If clean:
Staged changes look clean. {N} files, {additions}+/{deletions}-.
Ready to commit.
If issues found:
## Pre-commit Check: {N} files
### Blockers
- {file}:{line} — {issue}
### Warnings
- {file}:{line} — {issue}
{Blockers} must be fixed. {Warnings} are your call.
4. Do NOT
- Suggest refactoring
- Comment on style or formatting
- Flag patterns that are consistent with the codebase
- Recommend architectural changes
- Add docstrings or comments
- Run tests (that's a separate step)
This is a quick gate, not a code review. For thorough review, use /age or /code-review.
Gotchas
- Haiku may miss subtle secrets (base64-encoded keys, hex tokens without common prefixes)
- Binary files in the diff produce noise — skip files detected as binary
sgpattern matching operates on full files, not diff hunks — patterns may match pre-existing code- Delta pager can interfere with raw diff capture — use
--no-pagerfor machine-readable output
Related Skills
paulnsorensen/work-recovery
tools
VerifiedTrustedCommunity
Reconstruct what a past coding-agent session was doing so you can resume it — goal, files touched, last verified state, and the next step — by querying the session logs. Use when the user says "what was I working on", "recover that session", "reconstruct where I left off", "resume my last session", "what did that session change", "rebuild context from logs", or invokes /work-recovery. Report-only — it never scores or judges. Do NOT use for usage scoring (that is /skill-improver, /tool-efficiency, /prompt-analytics) or one-off interactive log queries (that is /session-analytics).
2SKILL.mdUpdated Jun 3, 2026
paulnsorensen/wiki-curator
development
VerifiedTrustedCommunity
Curate this repo's hallouminate wiki (.hallouminate/wiki/, the repo:dotfiles:wiki corpus) — add or update architecture pages, per-harness docs, and gotchas. Use when the user says "update the wiki", "document this in the wiki", "refresh the harness docs", "add a wiki page", "curate the wiki", "the wiki is stale", or invokes /wiki-curator. Also use at session end to write back a non-obvious decision or gotcha worth preserving. Grounds the existing wiki first, follows one-topic-per-file conventions, verifies every external doc URL before writing, and reindexes. Do NOT use for general code search (that is cheez-search) or for editing AGENTS.md command reference.
2SKILL.mdUpdated Jun 3, 2026
paulnsorensen/tool-efficiency
tools
VerifiedTrustedCommunity
Audit how a tool, command, or MCP server is actually used across coding-agent sessions and produce calibrated recommendations — tool-vs-task fit, error forensics, fix recommendations, permission friction, MCP health, and token economics. Use when the user says "tool efficiency", "am I using X efficiently", "audit tool usage", "why does X keep failing", "how do I fix this error", "what should I change", "permission friction", "is this MCP worth it", "tool error rate", "fix recommendations", or invokes /tool-efficiency. Do NOT use for auditing a skill or agent definition (that is /skill-improver) or for one-off interactive log queries (that is /session-analytics).
2SKILL.mdUpdated Jun 3, 2026
paulnsorensen/prompt-analytics
tools
VerifiedTrustedCommunity
Analyze how prompts and skill routing behave across coding-agent sessions and produce calibrated recommendations — prompt-pattern analysis, routing accuracy, and knowledge gaps. Use when the user says "analyze my prompts", "prompt patterns", "is routing working", "which skill should have fired", "knowledge gaps", "what do I keep asking", or invokes /prompt-analytics. Do NOT use for auditing a single skill/agent definition (that is /skill-improver), tool/MCP efficiency (that is /tool-efficiency), or one-off interactive log queries (that is /session-analytics).
2SKILL.mdUpdated Jun 3, 2026