Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.
The differential-review skill provides a security-focused analysis of code changes across pull requests, commits, and diffs. It addresses the challenge of identifying potential security regressions in evolving codebases by adapting the review depth based on the size of the codebase and utilizing git history to provide context for each change. By automating comprehensive checks, it ensures that critical security issues such as authentication flaws, cryptography weaknesses, and risky external calls are identified before they reach production, thus reducing the likelihood of vulnerabilities slipping through manual reviews.
This skill offers a range of features designed for thorough and evidence-based security assessment. It calculates the blast radius of changes, evaluates test coverage, and scales its methodology according to codebase size, from small to large projects. Key capabilities include generating structured markdown reports, explicitly noting confidence levels and coverage limits, and modeling adversarial scenarios for high-risk changes. Additionally, it integrates with an agent called adversarial-modeler for attacker perspective simulations, ensuring concrete attack scenarios and exploitability ratings are considered during the review process. The skill emphasizes risk-first decision-making, backing every finding with specific line numbers, git history, and attack scenarios.
Differential-review is suitable for security engineers, software developers, and code reviewers who need to maintain high standards of security in collaborative development environments. It is particularly useful for teams working with large or complex codebases where manual review may overlook subtle but critical security issues. The skill supports both detailed phase-by-phase analysis and quick triage, making it adaptable for continuous integration pipelines, high-risk feature deployments, or audit preparation, thereby empowering teams to maintain secure and resilient software systems.
It can analyze pull requests, individual commits, and diffs, focusing on security-critical aspects such as authentication, cryptography, external calls, and value transfer.
Yes, it adjusts its review strategy based on the codebase size: deep analysis for small projects, focused review for medium projects, and surgical review for large projects.
Yes, the skill produces comprehensive markdown reports that document findings, reference line numbers and commits, and include risk ratings and confidence levels.
Absolutely. For high-risk changes, it can utilize the adversarial-modeler agent to simulate attacker perspectives and generate structured exploit scenarios.
The skill explicitly states coverage limits and confidence levels in its reports, and some phases may be constrained by codebase size or missing test coverage.
Quick Setup:
.claude/skills/Repository
trailofbits/skills