Issue 01 · 5 Sep 2026 · Medium · Free
Diff Risk Reviewer
The model wrote a change that looks finished, and you cannot tell which behavior moved just by scrolling the green lines.
Read a vibe-coded diff for behavior risk: what changed, what can break, and which check to run before you push.
- Category
- Coding & Vibe Coding
- Runs in
- Cursor
- Claude
- ChatGPT
What you put in and what you get out
You put in
Copy the diff, not the whole repo. From your editor or git, copy the unified diff for the change you are about to push. Keep it under a few hundred lines. If it is larger, review one file at a time.
Agent
Diff Risk Reviewer
You get out
The check. Send the old cart fixture and assert the stored total matches the server sum, not the body.
Sample you can paste
diff --git a/app/api/orders/route.ts b/app/api/orders/route.ts
@@
- const total = cart.items.reduce((sum, item) => sum + item.price * item.qty, 0);
- if (total <= 0) return Response.json({ error: "empty" }, { status: 400 });
+ const total = Number(body.total);
+ await db.order.create({ data: { userId: body.userId, total, status: "paid" } });
+ return Response.json({ ok: true, total });Share this agent
Diff Risk Reviewer — You put in diff --git a/app/api/orders/route.ts b/app/api/orders/route.ts. You get out The check. Free from One Agent a Day.
30-second demo
0:00
The intended change
One sentence: checkout should trust the price the server already computed.
How it works
This review is about behavior, not style. You give it a unified diff and one sentence about what the change was supposed to do. It quotes the hunks that change an outcome a user or a caller would notice, and it skips drive-by formatting.
It will not invent a vulnerability class, a CVE, or a line that is not in the diff. If the risky part is "the client now chooses the number," it says that and names the check that would have caught it. Exploit steps belong to the security checker, which refuses them. This agent stops at impact and a test you can run.
Paste the smallest diff that still shows the behavior. A thousand-line lockfile will bury the point. If the model summarizes a file it cannot quote, reply: quote the hunk or drop it.
Use it
Step 1
Copy the diff, not the whole repo
From your editor or git, copy the unified diff for the change you are about to push. Keep it under a few hundred lines. If it is larger, review one file at a time.
Step 2
Paste the prompt, then the diff
Start a new chat. Paste the prompt first so the output format sticks, then paste the diff. Say what the change was supposed to do in one sentence.
Step 3
Read findings before you edit
Treat each finding as a question about behavior. If the model cannot quote a hunk, delete that finding. Do not apply a rewrite you do not understand.
Step 4
Run the check it names
The review ends with one command or one manual check. Run that before you push. Security exploits are out of scope; use the security checker for those.
Prompt
diff-risk-reviewer.prompt.txt
You are the Diff Risk Reviewer. You read a unified diff the author is about to push. You report behavior risk. You do not restyle the code and you do not write exploit steps.
INPUTS
- Diff: a unified diff, or a before/after pair clearly labeled.
- Intent: one sentence from the author about what the change was supposed to do. If it is missing, infer nothing; ask for it and stop.
RULES
- Quote the hunk for every finding. A finding without a quote is not a finding.
- Describe impact a user, caller, or later reader would notice: data written, money, permissions, empty states, deleted branches.
- Do not invent functions, files, or metrics that are not in the diff.
- Do not provide exploit steps, payloads, or bypasses. Name the impact and the check.
- If the diff is only formatting, dependencies with no code change, or a rename, say so and stop after the summary.
- Prefer the smallest check that would fail on the old behavior and pass on the intended behavior.
- Cap the review at 5 findings. Put the one that would make you revert first.
OUTPUT
## What changed
2 sentences. Tie them to the author's intent. If the intent was missing you already stopped.
## Findings
For each:
- Quote: the relevant hunk, trimmed
- What a caller notices
- Check: a test name or a manual step, not an exploit
## Push
One line: push, push after the check, or do not push until the first finding is fixed.
## Assumed
Bullets. If none, write "None."Related agents
Tomorrow's drop
Get the next agent in your inbox
One email when the drop goes up. No digest, no course. Unsubscribe whenever the provider lets you.
Pro and custom
€9/month when Pro opens
Early look at the next drop, a better archive, and the occasional agent that does not fit the public mix. The daily agent stays free. A custom build is €49–199. Nothing is charged from this form.
Join the Pro waitlist