What is nuget-diff-analyzer?

A report generator for comparing two versions of a NuGet package, a package format used by .NET projects.

Use it to identify breaking changes, additive changes, and newly obsolete APIs between package versions, especially during MAF upgrades.

It turns raw dotnet-inspect version-diff Markdown into categorized findings that are easier to review and connects newly obsolete APIs to the MAF registry.

nuget-diff-analyzer — Skill for Claude Code and Codex by joslat

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add joslat/maf-doctor --skill nuget-diff-analyzer

Clone the repo

git clone --depth 1 https://github.com/joslat/maf-doctor

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/joslat/maf-doctor/nuget-diff-analyzer/github.svg)](https://agentmods.dev/skills/joslat/maf-doctor/nuget-diff-analyzer)

Your own site

<a href="https://agentmods.dev/skills/joslat/maf-doctor/nuget-diff-analyzer"><img src="https://agentmods.dev/badge/skills/joslat/maf-doctor/nuget-diff-analyzer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/joslat/maf-doctor/nuget-diff-analyzer"><img src="https://agentmods.dev/badge/skills/joslat/maf-doctor/nuget-diff-analyzer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 56 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 700 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00056	$0.00700
Opus 5	$0.00028	$0.00350
Sonnet 5	$0.00011	$0.00140
Haiku 4.5	$0.00006	$0.00070

Measured 9d ago against content hash c052437c1891, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

nuget-diff-analyzer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/skills/nuget-diff-analyzer/SKILL.md · 52 lines

How it starts

The opening of the file, as written. The whole thing — 52 lines — stays where its author put it; the contents beside it link to each section on GitHub.

nuget-diff-analyzer — structured NuGet version-diff reports

⚡ Prefer the MCP tool. The maf-autopilot MCP server exposes MafDiffPackage(packageId, oldVersion, newVersion) — it targets the exact [email protected] -- diff format, parses the markdown output into a structured DiffParseResult (Breaking / Additive / NewlyObsolete lists), and cross-references each finding against the obsolete-API registry. The procedural walkthrough below is preserved for when you need to run the steps manually.

Why this exists

Raw dotnet-inspect diff output is markdown-pretty but unstructured — the LLM has to re-parse it on every call. The MCP tool does the parsing once and returns structured findings that downstream tools (best-practice reviewer, migration auditor) can consume directly.

Manual fallback workflow

# Step 1: emit the raw diff
dotnet-inspect diff \
  --package [email protected] --source https://api.nuget.org/v3/index.json

# Step 2: read the output. It has the shape:
#   # API Diff: <package>
#   | Versions | **1.2.0** -> **1.3.0** |
#   | Summary  | N breaking, M additive across K types |
#
#   ## Breaking Changes
#   ### <Type>
#   - Member '...' signature changed: `oldSig` -> `newSig`
#   - Member '...' was removed
#
#   ## Additive Changes
#   ### <Type>
#   - Type '...' was added
#   - Member '...' was added

# Step 3: for each breaking change, look up the registry:
#   MafApiSafety("<symbol-name>")
# or browse .github/skills/maf-obsolete-api-registry/registry.yaml

Output categories (what `MafDiffPackage` produces)

Category	Origin in diff output	Action
Breaking	`## Breaking Changes` section	Add to migration plan; high risk
Additive	`## Additive Changes` section	Inform future patterns; not urgent
NewlyObsolete	Any entry whose body contains `[Obsolete...]`	Inspect; likely a deprecation flag

Read the full file on GitHub · 52 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 52 lines · 56 tokens per session scan A c052437c1891

Subscribe to this mod's changes

nuget-diff-analyzer is a skill published in the GitHub repository joslat/maf-doctor (14 stars, last pushed 22d ago), licensed MIT. It adds 56 tokens to every session and 700 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

C# and .NET Debugging Languages agent ai-agents copilot dotnet framework maf

profiling

Use the free official .NET diagnostics CLI tools for profiling and runtime investigation in .NET repositories. USE FOR: the repo needs performance or runtime profiling for a .NET application; the user asks about slow code, high CPU, GC pressure, allocation growth, exception storms, lock. DO NOT USE FOR: replacing…

managedcode/dotnet-skills · 119 tokens

clr-activation-debugging

Diagnoses .NET Framework CLR activation issues using CLR activation logs (CLRLoad logs) produced by mscoree.dll. Use when: the shim picks the wrong runtime, fails to load any runtime, shows unexpected .NET 3.5 Feature-on-Demand (FOD) dialogs, unexpectedly does NOT show FOD dialogs, loads both v2 and v4 into the same…

managedcode/dotnet-skills · 102 tokens

check-bin-obj-clash

Detects MSBuild projects with conflicting OutputPath or IntermediateOutputPath. USE FOR: builds failing with 'Cannot create a file when that file already exists', 'The process cannot access the file because it is being used by another process', intermittent build failures that succeed on retry, or missing/overwritten…

managedcode/dotnet-skills · 160 tokens

dotnet-pinvoke

Correctly call native (C/C++) libraries from .NET using P/Invoke and LibraryImport. Covers function signatures, string marshalling, memory lifetime, SafeHandle, and cross-platform patterns. USE FOR: writing new P/Invoke or LibraryImport declarations, reviewing or debugging existing native interop code, wrapping a C or…

managedcode/dotnet-skills · 119 tokens

dotnet-aot-compat

Make .NET projects compatible with Native AOT and trimming by systematically resolving IL trim/AOT analyzer warnings. USE FOR: making projects AOT-compatible, fixing trimming warnings, resolving IL warnings (IL2026, IL2070, IL2067, IL2072, IL3050), adding DynamicallyAccessedMembers annotations, enabling…

managedcode/dotnet-skills · 112 tokens

build-perf-diagnostics

Diagnose MSBuild build performance bottlenecks using binary log analysis. USE FOR: identifying why builds are slow by analyzing binlog performance summaries, detecting ResolveAssemblyReference (RAR) taking >5s, Roslyn analyzers consuming >30% of Csc time, single targets dominating >50% of build time, node utilization…