Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cowork-os/security-diff-scan
Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.
Passed 18 of 22 test cases with the skill, and 12 of 22 without it.
and 4 more in the full report
6 fixed12 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
After running generate_rank_input.py to produce rank_input.csv for a PR diff, what script command populates deep_review_input.csv from the rank input CSV?
| Checked | Without skill | With skill |
|---|---|---|
| Runs the copy-deep-review-input command subcommand on the rank input file | Missed | Passed |
The instructions your model reads when the skill loads.
Used when a user wants to review a Git-backed change set for security regressions. Keep the scan phases separate and produce final HTML and markdown reports.
Keep these phases distinct and run them in linear order:
$threat-model$finding-discovery$validation$attack-path-analysisTreat this skill as the top-level orchestrator for the four skills plus the final report assembly step. Do not collapse the phases together.
For each phase:
Do not read ahead into later-phase skills until the current phase has completed. Do not amortize effort across phases: complete each phase to the full depth expected by that phase before moving on.
Before substantive scan work, create a Codex goal for the scan if the runtime exposes goal tools and no active goal already covers this scan. The objective should state that the scan must not stop until the resolved diff-scoped files have been covered and the required coverage artifacts prove that closure.
Use objective wording shaped like:
Run the Codex Security diff scan for <resolved target>; do not stop until every diff-scoped file/worklist row has a completion receipt or explicit deferred closure, every candidate has required ledger receipts, and the final report is written.
If a compatible active goal already exists, continue under it instead of creating a duplicate. If goal tools are unavailable, state the same coverage objective in the first visible scan update and continue.
Do not mark the goal complete until:
deep_review_input.csv row has a completion receipt in work_ledger.jsonl, or an explicit deferred, not_applicable, or suppressed closure with exact reasontest cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.