Two testing skills · both proven

differential-review vs receiving-code-review

Both skills were run through Claude twice: once on a fixed brief without the skill, once with it. The briefs differ because each is written for the job the skill claims to do, so compare each skill against its own baseline, then decide which difference matters for your work.

differential-review

Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else…

Category: Testing
Source: trailofbits/skills
License: Other
Proof model: claude-opus-5-5
Brief: “Do a security-focused review of this change and present it as a single HTML page. Commit: "Allow admins to impersonate users for support" +app.get('/admin/impersonate/:id', async (req, res) => { + if (req.cookies.role !== 'admin') return res.sendStatus(403); + const user = await User.findById(req.params.id); + req.session.userId = user.id; + res.redirect(req.query.next || '/'); +});”
Skill commit: 2be6433

Without the skillWith differential-review

⇆

Without, runWith differential-review, run3 independent runs per side, none selected by hand.

Download the with-skill page

receiving-code-review

Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation

Category: Testing
Source: obra/superpowers
License: MIT
Proof model: claude-opus-5-5
Brief: “I received this code review on my pull request that adds caching to our product API. Decide what to do with each comment and present your responses and planned changes as a single HTML page. 1. "Cache TTL of 24h is too long, prices change during the day." 2. "Use Redis instead of the in-memory Map so all 4 instances share the cache." 3. "Rename getProd to getProduct." 4. "You should rewrite this whole module in TypeScript." 5. "The cache key ignores the currency query param, so EUR users can get USD prices." 6. "Add a test."”
Skill commit: 2ce8aa1

Without the skillWith receiving-code-review

⇆

Without, runWith receiving-code-review, run3 independent runs per side, none selected by hand.

Download the with-skill page

We don’t pick a winner for you: the pages are the evidence. Both proofs can be repeated with the brief, model and commit shown above. See alternatives to differential-review or alternatives to receiving-code-review.