auditor:diff-audit

A security review of only the code changed in a Git commit or pull request, including nearby callers and callees.

In plain words
What is it for?
Use it to review pull requests, inspect commits, and prioritize changed code by risk and potential impact.
Why use it?
It narrows the review to the part most likely to contain a new bug or a removed security check instead of rescanning the whole project.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/solanabr/auditor-skill/diff-audit
Clone the repo
git clone --depth 1 https://github.com/solanabr/auditor-skill
Per session 40 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 251 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00040 $0.00251
Opus 5 $0.00020 $0.00125
Sonnet 5 $0.00008 $0.00050
Haiku 4.5 $0.00004 $0.00025

Measured 2d ago against content hash 4bd258b578bb, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

auditor:diff-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/diff-audit.md · 17 lines

What it actually says

auditor-skill — Differential Audit (Mode 4)

Arguments: $ARGUMENTS

  1. Compute the changed set: git diff --name-only <base>..<head> (default main..HEAD).
  2. Run Phase 0.5 Context Reconstruction on changed functions + their direct callers/callees (1-hop).
  3. Risk-classify changed files (auth / crypto / value-transfer / validation-removal = HIGH). Git-blame removed security code — code deleted in a "fix" / "CVE" commit is a CRITICAL regression.
  4. Run only the checklist items + known-vectors matching the changed files' language/domain, through the Rule 5b gate.
  5. Emit audit_<n>/PR-REPORT.md — changed-surface verdicts + findings only. Reuses the methodology corpus; skips whole-repo discovery.
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 17 lines · 40 tokens per session scan A 4bd258b578bb

Subscribe to this mod's changes

auditor:diff-audit is a command published in the GitHub repository solanabr/auditor-skill (52 stars, last pushed 1mo ago), licensed MIT. It adds 40 tokens to every session and 251 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.