explain-diff — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited explain-diff (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read-only template render. Wraps bin/explain-diff.sh.
doctor (which can chain into this via --explain).retrofit.Three call shapes:
1. Direct: file path
bin/explain-diff.sh --file path/to/drift.json2. Pipe from a producer
bin/compute-drift.sh --target . --profile default | bin/explain-diff.sh -3. Via doctor (recommended path)
bin/doctor.sh --target . --profile default --explaindoctor --explain is preferred because it also forwards the computed health score and trend delta into the narrative header line — the same numbers text-mode shows at the foot of its output.
--explain is mutually exclusive with --json on doctor; if both are passed, doctor dies with a clear error.
Markdown (default) — three sections:
Action required:, Worth fixing:, Drifted:, Minor:) and up to 5 concrete items. If a category has more than 5 items, an "...and N more" line appears.nyann:retrofit, nyann:optimize-claudemd, etc.)JSON (`--format json`) — the DriftNarrative shape (schemas/drift-narrative.schema.json). Useful for chat-bot integrations or custom renderers that want the same source-of-truth without re-parsing the prose.
| Severity | Lead | Sources |
|---|---|---|
| critical | "Action required:" | missing[], broken links, claude_md=error |
| high | "Worth fixing:" | misconfigured[], claude_md=warn / absent, subsystem errors |
| medium | "Drifted:" | orphans, staleness, misplaced[] |
| low | "Minor:" | non-compliant history (informational; nyann doesn't rewrite history) |
| info | (suppressed in markdown) | reserved for downstream filtering via the JSON shape |
The mapping is intentionally fixed (no profile-level override) so a narrative pasted into a PR reads the same regardless of which profile produced the underlying report.
When the user asks for "the drift in plain English":
## What's drifted bullets — the section count IS the summary number. E.g. "3 categories drifted: hooks (critical), claude_md (high), history (informational)."## What's drifted section appears), the narrative says so explicitly — don't editorialise.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.