semantic-code-analyzer
LLM-powered semantic analysis of code diffs to detect business-logic trojans
npx skills add a5c-ai/babysitter --skill semantic-code-analyzer --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Semantic Code Analyzer LLM-powered semantic analysis engine that detects business-logic trojans by comparing code intent (docstrings, function names, variable names) against actual implementation behavior. ## Purpose The core detection capability of nation-state trojan detection. Traditional SAST tools check syntax; this skill checks **semantics** — whether the code does what it claims to do. It catches operator substitutions, logic inversions, constant manipulation, narrative camouflage, and compound self-masking attacks. ## Capabilities ### Intent vs Implementation Analysis - Reads function names, docstrings, and variable names to establish **intent** - Traces code execution to determine **actual behavior** - Flags any contradiction as a potential trojan indicator ### Mathematical Verification - Plugs concrete values into changed formulas - Computes before/after results to quantify impact - Detects ratio inversions (a/b vs b/a), precision loss (/ vs //), and threshold shifts ### Docstring Contradiction Detection - Compares narrative claims in comments/docstrings against code behavior - Detects narrative camouflage where docs are updated to match malicious code - Cross-reference
- Purpose
- Capabilities
- Intent vs Implementation Analysis
- Mathematical Verification
- Docstring Contradiction Detection
- Test Evasion Analysis
- Blast Radius Mapping
- Input Schema
- Output Schema
- Usage Example
- Attack Signatures Detected
- Process Files
What does the semantic-code-analyzer skill do?
LLM-powered semantic analysis of code diffs to detect business-logic trojans
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill semantic-code-analyzer --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.