| name | review-diff |
| description | Scan git diffs for project-specific anti-patterns. Triggers on: 'scan diff', 'check diff', 'anti-pattern check', 'pattern scan', 'review changes'. |
| user-invocable | true |
| argument-hint | [branch | commit-range | empty=uncommitted] |
Scan a git diff for project-specific anti-patterns. This is a fast, targeted scan (seconds), not a full code review. Use /review for comprehensive analysis.
Step 0: Detect project
Ensure you are inside a git repository before running diff commands:
- If cwd is a git repo: use it
- If recent context references a project:
cd into it first
- Check
CLAUDE.md or the project manifest (package.json, composer.json, pom.xml, Gemfile, *.csproj, go.mod, Cargo.toml, requirements.txt/pyproject.toml, etc.) in the project root to identify the framework and project-specific patterns
- If unclear: ask which project
Step 1: Get the diff
Determine the diff source from $ARGUMENTS:
- No arguments: Run
git diff (unstaged) + git diff --cached (staged). Combine both outputs.
- Branch name (e.g.,
feat/xyz): Run git diff main...$ARGUMENTS
- Commit range (e.g.,
HEAD~3..HEAD): Run git diff $ARGUMENTS
- Single commit hash: Run
git diff $ARGUMENTS~1..$ARGUMENTS
If the diff is empty, report "No changes to scan." and stop.
Step 2: Scan for anti-patterns
Analyze ONLY + lines (additions) in the diff. For each pattern below, search the added lines and the surrounding file context when needed.
Pattern Table
| # | Pattern | What to look for | Severity |
|---|
| 1 | Filter logic mismatch | String === comparisons where one value could be a prefix of the other (e.g., 'All' === value when value could be 'All Categories'). Also: inconsistent use of startsWith() vs === on the same field across the diff. This requires semantic understanding, not just regex. | HIGH |
| 2 | Auth gaps | New defineEventHandler, @Get(), @Post(), @Put(), @Delete(), @Patch() without a corresponding @UseGuards() or defineMiddleware in the same file. Read the full file if needed to check. | HIGH |
| 3 | Soft-delete violations | DELETE FROM, .delete(, .deleteMany(, .destroy( in any ORM/SQL (adapt the delete-method names to your ORM) without corresponding is_active or deleted_at in the same block. Many projects require soft-delete: is_active=false + deleted_at=new Date(). Check CLAUDE.md for the project's soft-delete convention. | CRITICAL |
| 4 | (Nuxt/Vue projects, adapt for your framework) API call pattern | $fetch( or useFetch( in .vue files when the project uses a custom API composable. Check CLAUDE.md for the project's API composable (e.g., a wrapper around $fetch). Exception: server-side code in server/ directories may use $fetch. | MEDIUM |
| 5 | (Nuxt/Vue projects, adapt for your framework) Navigation pattern | router.push( or router.replace( in .vue files when the framework provides a preferred navigation function. Check CLAUDE.md for the framework-specific navigation function. | MEDIUM |
| 6 | Secrets in diff | Patterns like password:, token:, secret:, apiKey:, DATABASE_URL followed by a quoted string literal (not process.env., useRuntimeConfig(), or env variable references). | CRITICAL |
| 7 | (Nuxt/Vue projects, adapt for your framework) External route gap | New files added under server/routes/ or server/api/, check if corresponding frontend navigation uses external: true and <a href> instead of <NuxtLink>. Flag if unclear. | LOW |
| 8 | N+1 queries | findMany, findFirst, findUnique called inside for, for...of, forEach, .map(, while loops. Each iteration hits the DB separately instead of batching. | HIGH |
| 9 | (Nuxt/Vue projects, adapt for your framework) CJS default import | import X from 'cron-parser' or similar default imports from known CJS packages (cron-parser, lodash, moment). In Nuxt 4 + Vite, use named imports: import { CronExpressionParser } from 'cron-parser'. | MEDIUM |
| 10 | (Nuxt/Vue projects, adapt for your framework) DevServer binding | 0.0.0.0 appearing in config files (vite.config, nuxt.config, devServer sections). Binds to all network interfaces; security risk. | HIGH |
Step 3: Build findings table
For each finding, extract:
- File: from the diff
+++ b/... header
- Line: calculate from
@@ -X,Y +Z,W @@ hunk headers by counting + lines
- Pattern: the pattern name from the table above
- Finding: the specific line or code that triggered the match
- Recommendation: what to change
Output format:
| # | Severity | File | Line | Pattern | Finding | Recommendation |
|---|----------|------|------|---------|---------|----------------|
| 1 | CRITICAL | path/to/file.ts | 42 | Soft-delete | `.delete({ where: ... })` | Use `update({ is_active: false, deleted_at: new Date() })` |
If no findings: "No anti-patterns detected in the diff. GO."
Step 4: Summary
Review-diff: X findings (Y critical, Z high, W medium, V low)
Verdict: GO / REVIEW NEEDED
- GO: 0 critical, 0 high findings
- REVIEW NEEDED: any critical or high findings present
