Install
$ agentstack add skill-shubhamsaboo-awesome-llm-apps-scope-creep-detector ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Scope Creep Detector
A one-line fix should not require a reviewer to reverse-engineer fourteen files across three subsystems. This skill compares a git diff with its stated intent, surfaces scope signals, and turns them into keep, split, or justify decisions.
Everything runs locally. The script makes no network calls and does not change the working tree, index, commits, or branches.
When to use
- Before opening a pull request whose diff may have grown beyond its intent
- When a bug fix touches unexpected files or subsystems
- When the user asks whether staged changes are too broad
- When a diff includes dependency, public API, config, CI, or build changes
- When the user wants a concrete split plan for a mixed change
When not to use
- Formatting code, running a linter, or writing a commit message
- Reviewing correctness, security, or test quality inside an agreed scope
- Measuring historical project growth across many commits
- Editing or reverting files without the user's approval
Establish the intent
Use the user's one-line intent when available. Keep it concrete, such as fix null dereference in parser or add retry limit to webhook delivery.
If no intent was given, the script falls back to the current branch name. If that name is generic, detached, or unrelated to the work, ask for one line of intent before treating relatedness as meaningful.
Run the classifier
Run from this skill directory and point --repo at the target repository.
Working tree diff:
python3 scripts/scope_creep.py --repo /path/to/repo \
--intent "fix null dereference in parser" --json
Staged diff:
python3 scripts/scope_creep.py --repo /path/to/repo --staged \
--intent "fix null dereference in parser" --json
Branch diff against a merge base:
python3 scripts/scope_creep.py --repo /path/to/repo --base main \
--intent "fix null dereference in parser" --json
Saved diff or stdin:
python3 scripts/scope_creep.py --diff change.diff --intent "parser fix" --json
git diff --staged | python3 scripts/scope_creep.py --diff - \
--intent "parser fix" --json
Use --hunk-threshold only when the repository has a documented reason to change the default churn threshold. Do not tune the threshold merely to make a warning disappear.
Interpret the JSON
Read [references/scope-signals.md](references/scope-signals.md) before making a recommendation. Treat the classifier as triage evidence, not proof of authorial intent.
in_scope: file paths with at least one intent/path keyword overlaplikely_creep: paths without overlap, with the reason and detected signalsnew_deps: dependencies introduced in supported manifest formatsapi_renames: nearby removed and added public function or class declarationsconfig_edits: CI, container, build, YAML, and TOML changesstats: churn, subsystem counts, oversized hunks, and formatting-only files
Empty arrays are evidence too. Say that no signal was detected, not that the diff is guaranteed to be in scope.
Recommend keep, split, or justify
Give every item in likely_creep one disposition:
- Keep when the path is necessary for the stated intent and the connection
is direct. Explain the connection in one sentence.
- Split when it can land independently, belongs to another subsystem, or
introduces a dependency, API rename, config edit, or large hunk that is not required for the intent. Name the files or hunks for the follow-up change.
- Justify when a cross-cutting edit cannot be separated safely. State the
invariant or build constraint that requires it and call out reviewer risk.
Prefer split when evidence is ambiguous. Never claim that a zero overlap score proves a file is unrelated. Path vocabulary is a cheap, deterministic proxy.
Write the scope report
Use this compact structure:
- Intent and diff source
- Files and subsystems touched, with total additions and deletions
- In-scope changes
- Likely creep with signal evidence
- Keep, split, or justify table
- Proposed follow-up grouping, if any
Name file paths and hunk headers. For an oversized mixed hunk, explain that the script cannot split it automatically and describe the smallest coherent edit. Ask before applying any split, revert, staging, or commit operation.
Files
scripts/scope_creep.py: deterministic unified-diff parser and classifierreferences/scope-signals.md: signal definitions, thresholds, and limits
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Shubhamsaboo
- Source: Shubhamsaboo/awesome-llm-apps
- License: Apache-2.0
- Homepage: https://www.theunwindai.com
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.