differential-review

What this skill does

Analyzes git diffs, pull request changes, and commit ranges for security regressions. Unlike a full codebase audit, this skill focuses exclusively on what changed: additions that introduce new vulnerabilities (hardcoded secrets, injection sinks, unsafe deserialization), and removals that eliminate security controls (auth checks, input validation, rate limiting). It classifies changed files by risk tier, runs targeted pattern checks on additions and deletions, cross-references dependency changes, and produces a prioritized findings list with severity.

When to use

• During pull request review when you need a security-focused lens on the diff specifically
• When a commit range is suspected of introducing a regression (e.g., after an incident or pentest finding)
• As a lightweight pre-merge gate before running a full secure-code-review
• When reviewing dependency bumps that may silently alter security behavior
• When a developer says "I only changed X" and you need to verify that claim from a security perspective

Prerequisites

• Git access to the repository (local clone or remote diff URL)
• git CLI available in the environment
• (Optional) semgrep for automated pattern matching on additions
• Read access to dependency manifests (package.json, go.mod, requirements.txt, Cargo.toml, etc.)