Menu
Git diff forensics for surfacing and classifying code changes for trojan detection
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Orchestrate via @babysitter. Use this skill when asked to babysit a run, orchestrate a process or whenever it is called explicitly. (babysit, babysitter, orchestrate, orchestrate a run, workflow, etc.)
Orchestrate via @babysitter. Use this skill when asked to babysit a run, orchestrate a process or whenever it is called explicitly. (babysit, babysitter, orchestrate, orchestrate a run, workflow, etc.)
Clean up .a5c/runs and .a5c/processes directories. Aggregates insights from completed/failed runs into docs/run-history-insights.md, then removes old run data and orphaned process files.
Submit feedback or contribute to babysitter project
manage babysitter plugins. use this command to see the list of installed babysitter plugins, their status, and manage them (install, update, uninstall, list from marketplace, add marketplace, configure plugin, create new plugin, etc).
Orchestrate via @babysitter. Use this skill when asked to babysit a run, orchestrate a process or whenever it is called explicitly. (babysit, babysitter, orchestrate, orchestrate a run, workflow, etc.)
| name | git-forensics-scanner |
| description | Git diff forensics for surfacing and classifying code changes for trojan detection |
| allowed-tools | ["Bash","Read","Glob","Grep"] |
Surfaces and classifies all code changes in a repository using git diff analysis, providing structured change sets for downstream semantic analysis.
The first phase of nation-state trojan detection: identify exactly what changed, how much changed, and classify each change by risk level. Small diffs in critical code paths are flagged as highest-risk since business-logic trojans typically modify 1-5 lines.
git diff)git diff --cached)git diff <base>..<head>)git diff <base>...<head>){
"type": "object",
"required": ["projectRoot"],
"properties": {
"projectRoot": {
"type": "string",
"description": "Absolute path to the git repository"
},
"scanMode": {
"type": "string",
"enum": ["uncommitted", "commit-range", "branch-diff"],
"default": "uncommitted"
},
"baseRef": {
"type": "string",
"description": "Base git reference (for commit-range/branch-diff)"
},
"headRef": {
"type": "string",
"description": "Head git reference (for commit-range/branch-diff)"
},
"targetPaths": {
"type": "array",
"items": { "type": "string" },
"description": "Limit scan to specific paths"
}
}
}
{
"type": "object",
"required": ["totalFiles", "files"],
"properties": {
"totalFiles": { "type": "number" },
"totalInsertions": { "type": "number" },
"totalDeletions": { "type": "number" },
"files": {
"type": "array",
"items": {
"type": "object",
"properties": {
"path": { "type": "string" },
"insertions": { "type": "number" },
"deletions": { "type": "number" },
"hunks": { "type": "number" },
"classification": { "type": "string" },
"rawDiff": { "type": "string" },
"riskLevel": { "type": "string" }
}
}
}
}
}
skill: {
name: 'git-forensics-scanner',
context: {
projectRoot: '/path/to/project',
scanMode: 'uncommitted'
}
}
nation-state-trojan-detection.js โ Phase 1: Git Forensics task