windiff-version-diff-analysis

windiff-version-diff-analysis is a Blue team & detection skill for AI agents, published by ergrelet in the windiff repository on GitHub. Skillspace rates windiff-version-diff-analysis C (72/100) and it passed the safety scan; the rating is based on static analysis only.

Generate and analyze a diff between two Windows versions (or two patch levels of one version) for security research, using the WinDiff CLI in this repo. Use this whenever the user wants to compare Windows builds to find what Microsoft changed between versions — new or removed syscalls, new exported/internal kernel routines, added structures or struct fields, new security mitigation flags (process/thread mitigations, CFG/CET/XFG, Code Integrity / ci.dll, kCET, win32k lockdown), AND any other new security-relevant feature or component: new kernel notification/callback surface (Ps/Ob/Cm callbacks, ETW providers and the EtwTi threat-intel channel, minifilter/altitude hooks), new telemetry, ELAM/AMSI/PPL/anti-tamper changes, and brand-new drivers or modules. Frame findings for three audiences — anti-malware / EDR developers, anti-cheat developers, and vulnerability researchers. Triggers on requests like "diff ntoskrnl between 21H2 and 23H2", "what new syscalls were added in 24H2", "what…

Grade

C

Quality

72 / 100

Safety

Passed

GitHub stars

388

Unproven: rated by static analysis only, not yet compared head-to-head.

Not launch-quality. It is graded C with a clean safety verdict, but our quality filters exclude it: it looks written only for the repository it lives in. So it is not in our launch-quality set, the skills our MCP server searches and recommends. How launch-quality is decided

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.