differential-review
Security-focused differential analysis of code changes with adaptive depth, blast radius calculation, and markdown reporting.
- Analyzes PRs, commits, and diffs across three codebase sizes (SMALL/MEDIUM/LARGE) with risk-first prioritization on auth, crypto, value transfer, and external calls
- Includes six-phase workflow: triage, code analysis, test coverage assessment, blast radius calculation, adversarial modeling, and comprehensive markdown report generation
- Detects security regressions through git history analysis, identifies removed security code via blame, and flags high-risk patterns like validation removal or access control changes
- Integrates with audit-context-building for baseline context and issue-writer for formal audit report transformation
- Provides explicit coverage limits and confidence levels; escalates on red flags like high blast radius changes or removed security commits
Differential Security Review
Security-focused code review for PRs, commits, and diffs.
Core Principles
- Risk-First: Focus on auth, crypto, value transfer, external calls
- Evidence-Based: Every finding backed by git history, line numbers, attack scenarios
- Adaptive: Scale to codebase size (SMALL/MEDIUM/LARGE)
- Honest: Explicitly state coverage limits and confidence level
- Output-Driven: Always generate comprehensive markdown report file
Rationalizations (Do Not Skip)
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "Small PR, quick review" | Heartbleed was 2 lines | Classify by RISK, not size |
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.2Ksemgrep
>-
3.8Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.8Kcodeql
>-
3.6Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.5Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.4K