Design vs Testing · both proven

crypto-protocol-diagram vs systematic-debugging

Both skills were run through Claude twice: once on a fixed brief without the skill, once with it. The briefs differ because each is written for the job the skill claims to do, so compare each skill against its own baseline, then decide which difference matters for your work. They are in different categories, so this is a choice of job, not a head-to-head on the same job.

crypto-protocol-diagram

Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagrams with cryptographic annotations. Use when diagramming a crypto protocol, visualizing a handshake or key exchange flow, extracting message flow from a spec or RFC, diagramming a ProVerif or Tamarin model, or drawing…

Category: Design
Source: trailofbits/skills
License: Other
Proof model: claude-opus-5-5
Brief: “Draw the message flow of this login protocol as a single HTML page with an SVG sequence diagram, and note any weaknesses. 1. Client sends username to server. 2. Server replies with a random 16-byte nonce and the user's salt. 3. Client computes H = SHA-256(salt || password) and sends HMAC-SHA256(key=H, msg=nonce). 4. Server looks up stored H, computes the same HMAC and compares. 5. On success the server returns a session token valid for 30 days.”
Skill commit: 2be6433

Without the skillWith crypto-protocol-diagram

⇆

Without, runWith crypto-protocol-diagram, run3 independent runs per side, none selected by hand.

Download the with-skill page

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

Category: Testing
Source: obra/superpowers
License: MIT
Proof model: claude-opus-5-5
Brief: “A Node.js API returns 500 for about 1 in 200 requests to POST /orders. Logs show 'TypeError: Cannot read properties of undefined (reading "id")' at orders.js:48, which reads req.user.id. The route is behind an auth middleware. The failures started after a deploy that added a 30-second cache on the session lookup. Present your diagnosis and fix as a single HTML page: what you checked, in order, the root cause, the code change, and how you would confirm it is fixed.”
Skill commit: bb92a77

Without the skillWith systematic-debugging

⇆

Without, runWith systematic-debugging, run3 independent runs per side, none selected by hand.

Download the with-skill page

We don’t pick a winner for you: the pages are the evidence. Both proofs can be repeated with the brief, model and commit shown above. See alternatives to crypto-protocol-diagram or alternatives to systematic-debugging.