Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Security-focused differential code review with blast radius analysis, risk-adaptive depth (DEEP/FOCUSED/SURGICAL), git history correlation, and structured finding format. Adapted from Trail of Bits. Use when reviewing PRs, commits, or code changes for security implications.
| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-04 | ✗→✓ | ▲ Improved | 32% | 0% |
| case-06 | ✗→✓ | ▲ Improved | 11% | 0% |
| case-12 | ✗→✓ | ▲ Improved | 15% | 0% |
| case-17 | ✗→✓ | ▲ Improved | 62% | 0% |
| case-18 | ✓→✓ | ＝ Same ✓ | 51% | 0% |
Security-focused code review that adapts depth to codebase size and change risk. Goes beyond style -- finds vulnerabilities, logic errors, and blast radius.
Before reading any code:
bash# What changed? git diff --stat <base>...<head> # How much changed? git diff --shortstat <base>...<head> # Which files are security-sensitive? git diff --name-only <base>...<head> | grep -iE '(auth|crypto|token|secret|permission|middleware|validator|sanitiz)'
Classify the change:
Check if the changed code has a history of bugs:
bash# How often has this file been changed? (churn = risk) git log --oneline --follow <file> | wc -l # Were there recent security fixes in this area? git log --oneline --grep="fix\|vuln\|security\|CVE" -- <file> # Who else has touched this code? git log --format='%an' -- <file> | sort | uniq -c | sort -rn
High churn + security fix history = increase review depth.
For each changed file, analyze in this order:
## [SEVERITY] Finding Title
**Location**: file.ts:42-58
**Category**: [Input Validation | Auth | Crypto | Data Flow | State | Logic]
**Confidence**: [HIGH | MEDIUM | LOW]
**Description**:
What the vulnerability is, in one paragraph.
**Impact**:
What an attacker can achieve by exploiting this.
**Proof**:
The specific code path or data flow that demonstrates the issue.
**Recommendation**:
Concrete fix with code example if possible.| Severity | Criteria | Examples | |----------|----------|---------| | CRITICAL | Remote exploitation, no auth required, data breach | SQL injection, auth bypass, RCE | | HIGH | Requires some access, significant impact | Privilege escalation, IDOR, stored XSS | | MEDIUM | Limited impact or complex exploitation | Reflected XSS, info disclosure, CSRF | | LOW | Minimal impact, defense-in-depth | Missing headers, verbose errors, weak config | | INFO | Best practice, no direct vulnerability | Code quality, missing rate limit, logging gap |
Common excuses that lead to missed findings. Do NOT accept these:
| Rationalization | Why It's Wrong | Required Action | |----------------|---------------|-----------------| | "It's behind auth" | Auth can be bypassed | Verify auth is enforced AND correct | | "We trust this input" | Trust boundaries change | Validate at every boundary | | "It's just internal" | Internal networks get compromised | Apply defense in depth | | "Nobody would do that" | Attackers do unexpected things | Test the unexpected case | | "We'll fix it later" | Later never comes in security | Flag it NOW with severity | | "The framework handles it" | Frameworks have bypasses | Verify the framework actually applies | | "It's the same as before" | Before might have been wrong too | Review the original if suspicious |
[ ] Blast radius assessed (files, trust boundaries, security controls)
[ ] Git history checked for churn and past security fixes
[ ] All new inputs validated
[ ] Auth/authz applied to new endpoints/paths
[ ] Error handling doesn't leak sensitive info
[ ] No hardcoded secrets or credentials
[ ] State mutations are atomic
[ ] Crypto usage follows current best practices
[ ] Logging doesn't include sensitive data
[ ] Removed code didn't contain security controls that are now missing
[ ] Dependencies added/updated are from trusted sources
[ ] Test coverage exists for security-critical pathsInspired by Trail of Bits differential-review plugin.
Other measured skills in the registry, with their headline benchmark lift.