review-diff
Skill73 starsChanged 4 months agoMITView on GitHub
Scan git diffs for project-specific anti-patterns. Triggers on: 'scan diff', 'check diff', 'anti-pattern check', 'pattern scan', 'review changes'.
- Reads credentials
19 other projects use a version of this.
Adopted by
Most recently taken up by
- jisuzzzz/haechitheir own version, first seen Nov 8, 2026
- anorth/agent-skillstheir own version, first seen Nov 3, 2026
- Hy0sh/claude-skillstheir own version, first seen Nov 3, 2026
- tounsils/claude-code-skillstheir own version, first seen Oct 25, 2026
- nesnilnehc/ai-cortextheir own version, first seen Oct 25, 2026
- bbvch-ai/aihub-coretheir own version, first seen Oct 25, 2026
Used with
Projects with it also use grilling.
Other files people use alongside this one.
Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
GoogleSkillgrilling
Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
Also in 3 projects that use this
Other versions19 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 19
- huytd/skills★ 19same name
- jisuzzzz/haechi★ 17same name
- bbvch-ai/aihub-core★ 16same name
- nesnilnehc/ai-cortex★ 8same name
- tardigrde/agent-skill-eval★ 4same name
- Hy0sh/claude-skills★ 2same name
- Pradnyeshp/Claude-Skills★ 2same name
- anorth/agent-skills★ 1same name
- erikediner/skills★ 1same name
- giacomo-ciro/skills★ 1same name
9 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository21 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- memory/CLAUDE.mdCLAUDE.md
- changelogSkill
- db-checkSkill
- deploy-checkSkill
- e2e-checkSkill
- elicit-requirementsSkill
- load-sessionSkill
- pr-reviewSkill
- register-projectSkill
- review-fullSkill
- save-diarySkill
- save-sessionSkill
- scaffold-projectSkill
- self-auditSkill
- session-endSkill
- sprint-planSkill
- statusSkill
- tech-radarSkill
- test-checkSkill
The file
We split this skill into the rules it gives an agent
9 rules. 0 are common, 6 are distinctive, and 3 are very specific to this project.
0
Common
Most of the 19 edited versions we read keep these.
6
Distinctive
This author's own choices. Worth a look.
3
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 12
Ensure you are inside a git repository before running diff commands:
- Distinctive: line 13
If cwd is a git repo: use it
- Very specific: line 14
If recent context references a project: cd into it first
- Very specific: line 15
Check CLAUDE.md or the project manifest (package.json, composer.json, pom.xml, Gemfile, *.csproj, go.mod, Cargo.toml, …
- Distinctive: line 16
If unclear: ask which project
- Distinctive: line 21
No arguments: Run git diff (unstaged) + git diff --cached (staged).
- Very specific: line 24
Single commit hash: Run git diff $ARGUMENTS~1..$ARGUMENTS
- Distinctive: line 26
If the diff is empty, report "No changes to scan." and stop.
- Distinctive: line 64
If no findings: "No anti-patterns detected in the diff.
“Common” is measured: kept by at least 6 in 10 of the 19 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Scan a git diff for project-specific anti-patterns. This is a fast, targeted scan (seconds), not a full code review. Use /review for comprehensive analysis.
Step 0: Detect project
Ensure you are inside a git repository before running diff commands:
- If cwd is a git repo: use it
- If recent context references a project:
cdinto it first - Check
CLAUDE.mdor the project manifest (package.json, composer.json, pom.xml, Gemfile, *.csproj, go.mod, Cargo.toml, requirements.txt/pyproject.toml, etc.) in the project root to identify the framework and project-specific patterns - If unclear: ask which project
Step 1: Get the diff
Determine the diff source from $ARGUMENTS:
- No arguments: Run
git diff(unstaged) +git diff --cached(staged). Combine both outputs. - Branch name (e.g.,
feat/xyz): Rungit diff main...$ARGUMENTS - Commit range (e.g.,
HEAD~3..HEAD): Rungit diff $ARGUMENTS - Single commit hash: Run
git diff $ARGUMENTS~1..$ARGUMENTS
If the diff is empty, report "No changes to scan." and stop.
Step 2: Scan for anti-patterns
Analyze ONLY + lines (additions) in the diff. For each pattern below, search the added lines and the surrounding file context when needed.
Pattern Table
| # | Pattern | What to look for | Severity |
| 1 | Filter logic mismatch | String === comparisons where one value could be a prefix of the other (e.g., 'All' === value when value could be 'All Categories'). Also: inconsistent use of startsWith() vs === on the same field across the diff. This requires semantic understanding, not just regex. | HIGH |
| 2 | Auth gaps | New defineEventHandler, @Get(), @Post(), @Put(), @Delete(), @Patch() without a corresponding @UseGuards() or defineMiddleware in the same file. Read the full file if needed to check. | HIGH |
| 3 | Soft-delete violations | DELETE FROM, .delete(, .deleteMany(, .destroy( in any ORM/SQL (adapt the delete-method names to your ORM) without corresponding is_active or deleted_at in the same block. Many projects require soft-delete: is_active=false + deleted_at=new Date(). Check CLAUDE.md for the project's soft-delete convention. | CRITICAL |
| 4 | (Nuxt/Vue projects, adapt for your framework) API call pattern | $fetch( or useFetch( in .vue files when the project uses a custom API composable. Check CLAUDE.md for the project's API composable (e.g., a wrapper around $fetch). Exception: server-side code in server/ directories may use $fetch. | MEDIUM |
| 5 | (Nuxt/Vue projects, adapt for your framework) Navigation pattern | router.push( or router.replace( in .vue files when the framework provides a preferred navigation function. Check CLAUDE.md for the framework-specific navigation function. | MEDIUM |
| 6 | Secrets in diff | Patterns like password:, token:, secret:, apiKey:, DATABASE_URL followed by a quoted string literal (not process.env., useRuntimeConfig(), or env variable references). | CRITICAL |
| 7 | (Nuxt/Vue projects, adapt for your framework) External route gap | New files added under server/routes/ or server/api/, check if corresponding frontend navigation uses external: true and <a href> instead of <NuxtLink>. Flag if unclear. | LOW |
| 8 | N+1 queries | findMany, findFirst, findUnique called inside for, for...of, forEach, .map(, while loops. Each iteration hits the DB separately instead of batching. | HIGH |
| 9 | (Nuxt/Vue projects, adapt for your framework) CJS default import | import X from 'cron-parser' or similar default imports from known CJS packages (cron-parser, lodash, moment). In Nuxt 4 + Vite, use named imports: import { CronExpressionParser } from 'cron-parser'. | MEDIUM |
| 10 | (Nuxt/Vue projects, adapt for your framework) DevServer binding | 0.0.0.0 appearing in config files (vite.config, nuxt.config, devServer sections). Binds to all network interfaces; security risk. | HIGH |
Step 3: Build findings table
For each finding, extract:
- File: from the diff
+++ b/...header - Line: calculate from
@@ -X,Y +Z,W @@hunk headers by counting+lines - Pattern: the pattern name from the table above
- Finding: the specific line or code that triggered the match
- Recommendation: what to change
Output format:
| # | Severity | File | Line | Pattern | Finding | Recommendation |
|---|----------|------|------|---------|---------|----------------|
| 1 | CRITICAL | path/to/file.ts | 42 | Soft-delete | `.delete({ where: ... })` | Use `update({ is_active: false, deleted_at: new Date() })` |If no findings: "No anti-patterns detected in the diff. GO."
Step 4: Summary
Review-diff: X findings (Y critical, Z high, W medium, V low)
Verdict: GO / REVIEW NEEDED- GO: 0 critical, 0 high findings
- REVIEW NEEDED: any critical or high findings present
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

