Design vs Testing · both proven

crypto-protocol-diagram vs receiving-code-review

Both skills were run through Claude twice: once on a fixed brief without the skill, once with it. The briefs differ because each is written for the job the skill claims to do, so compare each skill against its own baseline, then decide which difference matters for your work. They are in different categories, so this is a choice of job, not a head-to-head on the same job.

crypto-protocol-diagram

Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagrams with cryptographic annotations. Use when diagramming a crypto protocol, visualizing a handshake or key exchange flow, extracting message flow from a spec or RFC, diagramming a ProVerif or Tamarin model, or drawing…

Category: Design
Source: trailofbits/skills
License: Other
Proof model: claude-opus-5-5
Brief: “Draw the message flow of this login protocol as a single HTML page with an SVG sequence diagram, and note any weaknesses. 1. Client sends username to server. 2. Server replies with a random 16-byte nonce and the user's salt. 3. Client computes H = SHA-256(salt || password) and sends HMAC-SHA256(key=H, msg=nonce). 4. Server looks up stored H, computes the same HMAC and compares. 5. On success the server returns a session token valid for 30 days.”
Skill commit: 2be6433

Without the skillWith crypto-protocol-diagram

⇆

Without, runWith crypto-protocol-diagram, run3 independent runs per side, none selected by hand.

Download the with-skill page

receiving-code-review

Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation

Category: Testing
Source: obra/superpowers
License: MIT
Proof model: claude-opus-5-5
Brief: “I received this code review on my pull request that adds caching to our product API. Decide what to do with each comment and present your responses and planned changes as a single HTML page. 1. "Cache TTL of 24h is too long, prices change during the day." 2. "Use Redis instead of the in-memory Map so all 4 instances share the cache." 3. "Rename getProd to getProduct." 4. "You should rewrite this whole module in TypeScript." 5. "The cache key ignores the currency query param, so EUR users can get USD prices." 6. "Add a test."”
Skill commit: 2ce8aa1

Without the skillWith receiving-code-review

⇆

Without, runWith receiving-code-review, run3 independent runs per side, none selected by hand.

Download the with-skill page

We don’t pick a winner for you: the pages are the evidence. Both proofs can be repeated with the brief, model and commit shown above. See alternatives to crypto-protocol-diagram or alternatives to receiving-code-review.