Design vs Testing · both proven

crypto-protocol-diagram vs differential-review

Both skills were run through Claude twice: once on a fixed brief without the skill, once with it. The briefs differ because each is written for the job the skill claims to do, so compare each skill against its own baseline, then decide which difference matters for your work. They are in different categories, so this is a choice of job, not a head-to-head on the same job.

crypto-protocol-diagram

Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagrams with cryptographic annotations. Use when diagramming a crypto protocol, visualizing a handshake or key exchange flow, extracting message flow from a spec or RFC, diagramming a ProVerif or Tamarin model, or drawing…

Category: Design
Source: trailofbits/skills
License: Other
Proof model: claude-opus-5-5
Brief: “Draw the message flow of this login protocol as a single HTML page with an SVG sequence diagram, and note any weaknesses. 1. Client sends username to server. 2. Server replies with a random 16-byte nonce and the user's salt. 3. Client computes H = SHA-256(salt || password) and sends HMAC-SHA256(key=H, msg=nonce). 4. Server looks up stored H, computes the same HMAC and compares. 5. On success the server returns a session token valid for 30 days.”
Skill commit: 2be6433

Without the skillWith crypto-protocol-diagram

⇆

Without, runWith crypto-protocol-diagram, run3 independent runs per side, none selected by hand.

Download the with-skill page

differential-review

Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else…

Category: Testing
Source: trailofbits/skills
License: Other
Proof model: claude-opus-5-5
Brief: “Do a security-focused review of this change and present it as a single HTML page. Commit: "Allow admins to impersonate users for support" +app.get('/admin/impersonate/:id', async (req, res) => { + if (req.cookies.role !== 'admin') return res.sendStatus(403); + const user = await User.findById(req.params.id); + req.session.userId = user.id; + res.redirect(req.query.next || '/'); +});”
Skill commit: 2be6433

Without the skillWith differential-review

⇆

Without, runWith differential-review, run3 independent runs per side, none selected by hand.

Download the with-skill page

We don’t pick a winner for you: the pages are the evidence. Both proofs can be repeated with the brief, model and commit shown above. See alternatives to crypto-protocol-diagram or alternatives to differential-review.