Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Git diff forensics for surfacing and classifying code changes for trojan detection
.claude/skills/a5c-ai-git-forensics-scanner/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 350% | 0% |
| case-07 | ✗→✓ | ▲ Improved | 21% | 0% |
| case-10 | ✗→✓ | ▲ Improved | -29% | 0% |
| case-12 | ✗→✓ | ▲ Improved | -23% | 0% |
| case-14 | ✗→✓ | ▲ Improved | -30% | 0% |
Surfaces and classifies all code changes in a repository using git diff analysis, providing structured change sets for downstream semantic analysis.
The first phase of nation-state trojan detection: identify exactly what changed, how much changed, and classify each change by risk level. Small diffs in critical code paths are flagged as highest-risk since business-logic trojans typically modify 1-5 lines.
git diff)git diff --cached)git diff <base>..<head>)git diff <base>...<head>)json{ "type": "object", "required": ["projectRoot"], "properties": { "projectRoot": { "type": "string", "description": "Absolute path to the git repository" }, "scanMode": { "type": "string", "enum": ["uncommitted", "commit-range", "branch-diff"], "default": "uncommitted" }, "baseRef": { "type": "string", "description": "Base git reference (for commit-range/branch-diff)" }, "headRef": { "type": "string", "description": "Head git reference (for commit-range/branch-diff)" }, "targetPaths": { "type": "array", "items": { "type": "string" }, "description": "Limit scan to specific paths" } } }
json{ "type": "object", "required": ["totalFiles", "files"], "properties": { "totalFiles": { "type": "number" }, "totalInsertions": { "type": "number" }, "totalDeletions": { "type": "number" }, "files": { "type": "array", "items": { "type": "object", "properties": { "path": { "type": "string" }, "insertions": { "type": "number" }, "deletions": { "type": "number" }, "hunks": { "type": "number" }, "classification": { "type": "string" }, "rawDiff": { "type": "string" }, "riskLevel": { "type": "string" } } } } } }
javascriptskill: { name: 'git-forensics-scanner', context: { projectRoot: '/path/to/project', scanMode: 'uncommitted' } }
nation-state-trojan-detection.js — Phase 1: Git Forensics task| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→pass | 20,047 | 41,121 | +105% | 1 | 1 | 0% | 1,435 | 6,457 | +350% | 0 | 0 | — |
case-02 | fail→fail | 25,912 | 16,850 | -35% | 1 | 1 | 0% | 3,102 | 2,291 | -26% | 0 | 0 | — |
case-03 | fail→fail | 28,509 | 14,543 | -49% | 1 | 1 | 0% | 3,393 | 2,866 | -16% | 0 | 0 | — |
case-04 | fail→fail | 17,041 | 9,322 | -45% | 1 | 1 | 0% | 2,255 | 2,012 | -11% | 0 | 0 | — |
case-05 | fail→fail | 18,034 | 24,089 | +34% | 1 | 1 | 0% | 2,358 | 4,543 | +93% | 0 | 0 | — |
case-06 | fail→fail | 24,287 | 22,146 | -9% | 1 | 1 | 0% | 183 | 3,933 | +2049% | 0 | 0 | — |
case-07 | fail→pass | 10,721 | 13,337 | +24% | 1 | 1 | 0% | 1,883 | 2,286 | +21% | 0 | 0 | — |
case-08 | pass→pass | 9,798 | 11,481 | +17% | 1 | 1 | 0% | 1,598 | 1,708 | +7% | 0 | 0 | — |
case-09 | pass→pass | 14,386 | 16,331 | +14% | 1 | 1 | 0% | 2,090 | 2,789 | +33% | 0 | 0 | — |
case-10 | fail→pass | 14,395 | 9,950 | -31% | 1 | 1 | 0% | 2,272 | 1,623 | -29% | 0 | 0 | — |
case-11 | pass→pass | 12,160 | 8,876 | -27% | 1 | 1 | 0% | 1,739 | 1,472 | -15% | 0 | 0 | — |
case-12 | fail→pass | 15,769 | 8,087 | -49% | 1 | 1 | 0% | 1,795 | 1,382 | -23% | 0 | 0 | — |
case-13 | pass→pass | 11,413 | 8,062 | -29% | 1 | 1 | 0% | 1,122 | 1,360 | +21% | 0 | 0 | — |
case-14 | fail→pass | 11,756 | 5,113 | -57% | 1 | 1 | 0% | 1,888 | 1,326 | -30% | 0 | 0 | — |
case-15 | fail→pass | 30,622 | 6,837 | -78% | 1 | 1 | 0% | 1,304 | 1,163 | -11% | 0 | 0 | — |
case-16 | fail→pass | 9,433 | 8,774 | -7% | 1 | 1 | 0% | 1,629 | 1,235 | -24% | 0 | 0 | — |
case-17 | fail→pass | 12,599 | 8,039 | -36% | 1 | 1 | 0% | 1,296 | 1,444 | +11% | 0 | 0 | — |
case-18 | fail→pass | 18,969 | 7,934 | -58% | 1 | 1 | 0% | 2,710 | 1,437 | -47% | 0 | 0 | — |
case-19 | fail→pass | 20,336 | 2,436 | -88% | 1 | 1 | 0% | 3,666 | 1,273 | -65% | 0 | 0 | — |
case-20 | pass→pass | 10,544 | 5,993 | -43% | 1 | 1 | 0% | 1,711 | 1,868 | +9% | 0 | 0 | — |
case-21 | fail→pass | 13,007 | 6,994 | -46% | 1 | 1 | 0% | 1,415 | 1,171 | -17% | 0 | 0 | — |
case-22 | fail→pass | 10,595 | 6,663 | -37% | 1 | 1 | 0% | 1,669 | 1,027 | -38% | 0 | 0 | — |
case-23 | fail→pass | 8,994 | 2,641 | -71% | 1 | 1 | 0% | 1,529 | 1,317 | -14% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted, and 21 counted toward the lift figure. The other 2 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +57 percentage points is the difference between those two pass rates over the 21 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.