New tool 'skilldiff' detects behavioral regressions in AI coding agent skill files

·84 views

A developer has released an open-source tool called skilldiff, designed to catch unintended behavioral changes when editing SKILL.md instruction files used by AI coding agents like Claude Code, Cursor, and Codex. The tool runs a skill file in a real agent environment against a fixture repository, comparing outputs from the old and new versions of the file across a pull request. Unlike standard text diffs, skilldiff tracks what the agent actually does — including files modified, commands executed, and tools invoked — rather than just what text changed. A built-in assertion system flags forbidden actions, such as an agent unexpectedly creating or modifying files it was not supposed to touch. In CI mode, the tool replays recorded traces deterministically without requiring an API key, and can post behavior reports directly to pull requests to block regressions from merging.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Python Functions Explained: Writing Reusable, Maintainable Code

Functions are a core Python concept that help developers write code that is reusable, organized, readable, and easier to maintain. Rather than repeating the same statements, a programmer can define a function once and call it whenever needed. The article illustrates this with an example where a repeated print statement is replaced by a welcome() function called three times. It also outlines the basic syntax, including the def keyword, the function name, parentheses, the colon, indented body, and the function call.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Audit hreflang Tags Across a Sitemap with Python's Standard Library

Hreflang annotations tell Google which pages are regional or language versions of each other, so each searcher sees the right one, but errors are easy to make and hard to spot in a browser. A new tutorial shows how to build a Python auditor using only the standard library that reads a sitemap, collects hreflang from sitemap entries, HTML and HTTP headers, and fetches every page and alternate. The script checks for missing return links, self-references, invalid language or region codes, x-default usage, relative URLs and broken alternates. Its output is a CSV and console summary, with an exit code suited to CI pipelines. The article is published by Appie.run, which also offers free tools mentioned in the piece, though the script does not depend on them. The guidance draws on Google Search Central documentation last updated in September 2026.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Digital footprint checks: how one engineering leader raised his score after a layoff

After a layoff, an engineering leader worried he might not find another job, and his mentor, Marian, used a digital footprint check to assess how a stranger would see his online presence. The check scores profiles against a typical 2026 baseline, and his rose from 0.9x to 1.17x, moving from "Nearly there" to "Worth a second look". His own check found some positive material, including past interviews and a mentoring role, which he added to his LinkedIn profile. The mentor also flagged that his last public appearance was in 2025 and suggested speaking engagements, plus improvements to his GitHub and direct contact with decision makers at meetups. The article argues that recruiters and AI screening tools increasingly judge candidates on their online presence, not just their CVs, and it describes a manual way to run the same check.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Check Point confirma ataque PHP2Shell que tomó control de cortafuegos y borró archivos

Check Point confirmó el 12 de noviembre que un atacante explotó el portal Mobile Access de sus puertas de enlace de seguridad para obtener control total de los equipos. En algunos casos limitados, el intruso llegó hasta servidores VMware ESXi y borró archivos. Los parches se publicaron el 23 de octubre, pero la explotación comenzó el 30 de octubre, dejando una ventana de una semana para los sistemas sin actualizar. Según la empresa, unos dos docenas de sistemas sin parchear fueron comprometidos, todos en una misma región. La campaña combinó dos fallos de ejecución remota sin autenticación con una escalada de privilegios, y en la primera oleada el borrado de datos dejó notas en hebreo sin pedir rescate.

0 comments Read more at DEV Community