Compares two versions of a requirements document and reports additions, removals, semantic changes, and scope drift — distinguishing clerical edits from meaning changes. Use when a spec was revised, when checking if a new version of a standard affects you, or when the user asks what changed between spec versions.
Install with Tessl CLI
npx tessl i github:santosomar/general-secure-coding-agent-skills --skill requirement-comparison-reporter100
Quality
100%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
A text diff of two specs is noise. Every reworded sentence shows as changed. The useful question is: what changed in meaning?
| Change class | Meaning impact | Example |
|---|---|---|
| Added | New obligation | v2 adds: "MUST support TLS 1.3" |
| Removed | Dropped obligation | v1 had: "MUST support TLS 1.0" — gone in v2 |
| Strengthened | Tighter constraint | "SHOULD encrypt" → "MUST encrypt"; "under 1s" → "under 500ms" |
| Weakened | Looser constraint | "MUST validate" → "SHOULD validate"; "all inputs" → "user-facing inputs" |
| Scope change | Same constraint, different applicability | "Applies to all endpoints" → "applies to public endpoints" |
| Clerical | None | Typo fix, renumbering, example added |
Match v1 requirements to v2 requirements. Don't diff line-by-line; diff requirement-by-requirement:
For each (v1_req, v2_req) pair, extract the claim structure:
| Component | Extract |
|---|---|
| Modal | MUST / SHOULD / MAY / MUST NOT |
| Subject | Who/what the requirement is about |
| Predicate | What they must/should/may do |
| Condition | "When X", "if Y", "unless Z" |
| Quantity | Numbers, ranges, thresholds |
Diff component-by-component. Modal change = strengthen/weaken. Quantity change = strengthen/weaken (direction depends). Condition change = scope change.
v1 §4.2: "The server SHOULD log authentication failures. Logs should be retained for at least 30 days."
v2 §4.2: "The server MUST log all authentication events (success and failure) with timestamp, source IP, and user identifier. Logs MUST be retained for 90 days in tamper-evident storage."
Component diff:
| Component | v1 | v2 | Delta |
|---|---|---|---|
| Modal | SHOULD | MUST | Strengthened |
| Subject | server | server | Same |
| Predicate | log auth failures | log all auth events + required fields | Scope expanded (failures → all events) + Added (field requirements) |
| Quantity | 30 days | 90 days | Strengthened (longer retention) |
| Condition | (none) | tamper-evident storage | Added (storage constraint) |
Impact: Existing implementation that logs failures only, 30-day retention, to a regular file: now non-compliant on 4 points. This is not a clerical revision.
Watch for weakening disguised as addition:
v1: "All API responses MUST be validated against the schema." v2: "All API responses MUST be validated against the schema, except during maintenance windows."
Text diff shows an addition. Semantic diff shows a weakening — the exception carves out a case where the constraint doesn't hold.
## Documents
v1: <name/version/date>
v2: <name/version/date>
## Summary
| Class | Count |
| ------------ | ----- |
| Added | |
| Removed | |
| Strengthened | |
| Weakened | |
| Scope change | |
| Clerical | <not itemized> |
## Added
| v2 ref | Text | Impact |
| ------ | ---- | ------ |
## Removed
| v1 ref | Text | Was anyone relying on this? |
| ------ | ---- | --------------------------- |
## Strengthened
| v1 ref | v2 ref | v1 | v2 | Delta | Implementations affected |
| ------ | ------ | -- | -- | ----- | ------------------------ |
## Weakened
<same columns — flag "hidden weakenings" via exception clauses>
## Scope changes
<same>
## Compliance impact
<for a known implementation: which changes break compliance, prioritized>47d56bb
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.