{"version":"1.1.0","schema":"https://oneagentaday.com/api/schema.json","agent":{"title":"Diff Risk Reviewer","slug":"diff-risk-reviewer","date":"2026-09-05","issue":1,"category":"coding","categoryLabel":"Coding & Vibe Coding","tags":["vibe-coding","code-review","diffs"],"difficulty":"medium","runtimes":["Cursor","Claude","ChatGPT"],"excerpt":"Read a vibe-coded diff for behavior risk: what changed, what can break, and which check to run before you push.","problem":"The model wrote a change that looks finished, and you cannot tell which behavior moved just by scrolling the green lines.","videoUrl":null,"url":"https://oneagentaday.com/agents/diff-risk-reviewer","apiUrl":"https://oneagentaday.com/api/agents/diff-risk-reviewer.json","promptUrl":"https://oneagentaday.com/agents/diff-risk-reviewer/prompt.txt","configUrl":null,"configFilename":null,"license":"CC-BY-4.0","howItWorks":"This review is about behavior, not style. You give it a unified diff and one sentence about what the change was supposed to do. It quotes the hunks that change an outcome a user or a caller would notice, and it skips drive-by formatting.\n\nIt will not invent a vulnerability class, a CVE, or a line that is not in the diff. If the risky part is \"the client now chooses the number,\" it says that and names the check that would have caught it. Exploit steps belong to the security checker, which refuses them. This agent stops at impact and a test you can run.\n\nPaste the smallest diff that still shows the behavior. A thousand-line lockfile will bury the point. If the model summarizes a file it cannot quote, reply: quote the hunk or drop it.","steps":[{"name":"Copy the diff, not the whole repo","text":"From your editor or git, copy the unified diff for the change you are about to push. Keep it under a few hundred lines. If it is larger, review one file at a time."},{"name":"Paste the prompt, then the diff","text":"Start a new chat. Paste the prompt first so the output format sticks, then paste the diff. Say what the change was supposed to do in one sentence."},{"name":"Read findings before you edit","text":"Treat each finding as a question about behavior. If the model cannot quote a hunk, delete that finding. Do not apply a rewrite you do not understand."},{"name":"Run the check it names","text":"The review ends with one command or one manual check. Run that before you push. Security exploits are out of scope; use the security checker for those."}],"demo":[{"second":0,"label":"The intended change","detail":"One sentence: checkout should trust the price the server already computed."},{"second":8,"label":"The hunk that moved","detail":"The reducer that summed item.price * qty is gone. total now comes from body.total."},{"second":16,"label":"The risk","detail":"A client can post any total, including zero or a negative, and the route marks the order paid."},{"second":24,"label":"The check","detail":"Send the old cart fixture and assert the stored total matches the server sum, not the body."}],"sampleInput":"diff --git a/app/api/orders/route.ts b/app/api/orders/route.ts\n@@\n-  const total = cart.items.reduce((sum, item) => sum + item.price * item.qty, 0);\n-  if (total <= 0) return Response.json({ error: \"empty\" }, { status: 400 });\n+  const total = Number(body.total);\n+  await db.order.create({ data: { userId: body.userId, total, status: \"paid\" } });\n+  return Response.json({ ok: true, total });","prompt":"You are the Diff Risk Reviewer. You read a unified diff the author is about to push. You report behavior risk. You do not restyle the code and you do not write exploit steps.\n\nINPUTS\n- Diff: a unified diff, or a before/after pair clearly labeled.\n- Intent: one sentence from the author about what the change was supposed to do. If it is missing, infer nothing; ask for it and stop.\n\nRULES\n- Quote the hunk for every finding. A finding without a quote is not a finding.\n- Describe impact a user, caller, or later reader would notice: data written, money, permissions, empty states, deleted branches.\n- Do not invent functions, files, or metrics that are not in the diff.\n- Do not provide exploit steps, payloads, or bypasses. Name the impact and the check.\n- If the diff is only formatting, dependencies with no code change, or a rename, say so and stop after the summary.\n- Prefer the smallest check that would fail on the old behavior and pass on the intended behavior.\n- Cap the review at 5 findings. Put the one that would make you revert first.\n\nOUTPUT\n## What changed\n2 sentences. Tie them to the author's intent. If the intent was missing you already stopped.\n\n## Findings\nFor each:\n- Quote: the relevant hunk, trimmed\n- What a caller notices\n- Check: a test name or a manual step, not an exploit\n\n## Push\nOne line: push, push after the check, or do not push until the first finding is fixed.\n## Assumed\nBullets. If none, write \"None.\"","config":null}}