Diff audit

Skill codecraftersautomation/claude-code/plugins/ccp/skills/diff-audit

Audit the current git diff before a handoff or commit to catch problems. Use when the user asks to "review my changes", "audit the diff", "check before handoff/commit", "did I leave anything bad in here", or before /ccp:handoff. Looks for accidental edits, generated/committed-by-mistake files, secrets, formatting noise, unfinished TODOs, risky permission changes, and destructive changes. Writes .claude/ccp/handoff/DIFF_AUDIT.md and does NOT modify files unless explicitly asked.From its SKILL.md

Install

npx -y skills add codecraftersautomation/claude-code --skill diff-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.3 KB, 432 tokens by cl100k_base, as published. Nobody here has run it

CCP: diff-audit

Review the working diff with a skeptical eye before it's handed to another profile or committed. The goal is to catch the things that quietly cause problems later: a debug print left in, a secret pasted into a config, a generated file that shouldn't be tracked, a chmod 777, a deletion that wasn't intended.

Steps

Inspect the diff:
```
git diff
git diff --staged
git status
```
Look for each of these categories and report findings with file + line references:
- Accidental edits — debug prints, commented-out code, stray whitespace-only churn, leftover scratch changes.
- Generated / vendored files that probably shouldn't be committed (build output, node_modules, lockfile churn that doesn't belong, large generated assets).
- Secrets — tokens, API keys, passwords, .env values, private keys. Report the location, not the value.
- Formatting issues — diffs that are 90% reformatting and obscure the real change; inconsistent indentation.
- Incomplete TODOs — TODO, FIXME, XXX, HACK, half-finished functions.
- Risky permission changes — files becoming executable, mode 777, ownership changes.
- Destructive changes — large deletions, removed tests, dropped error handling, schema/migration drops.
Write .claude/ccp/handoff/DIFF_AUDIT.md with a findings list grouped by category, each with severity (info / warning / blocker) and a one-line recommendation.

Read-only by default

Do not modify, stage, revert, or commit anything unless the user explicitly asks you to fix something. The audit informs; the human decides.

What this skill must never do

Never switch accounts or touch credentials/OAuth/Keychain data.
Never install plugins.
Never reprint a discovered secret in full — reference its location.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.