pr-security-review

PR Security Review

Automated security analysis of pull request diffs. Focuses on security-specific concerns that generic code review misses: injection vulnerabilities, authentication bypasses, hardcoded secrets, and insecure data handling introduced by the change.

When to Use

• Before merging any PR that touches authentication, authorization, or session handling
• Before merging PRs that add or modify API endpoints
• When a PR processes user input, file uploads, or external data
• Before merging PRs that update security-sensitive dependencies
• As a final gate before releasing to production

When NOT to Use

Instead of pr-security-review	Use
Full codebase audit (not a PR)	evaluate-repository + security-scan skills
Dependency-only update with no code change	npm audit / pip-audit directly
Code quality review (no security concerns)	code-review skill

Prerequisites

• Access to the PR diff (via get_diff or get_files GitHub MCP methods)
• Understanding of the application's trust boundary (what data is user-controlled)

Workflow

1. Fetch the PR diff

# Using GitHub MCP (built-in to Copilot CLI)
get_diff(owner, repo, pullNumber)

# Or review changed files
get_files(owner, repo, pullNumber)

2. Identify the attack surface in the diff

Before scanning for specific vulnerabilities, map what the PR adds or changes:

Attack surface checklist (mark relevant items):
[ ] New API endpoints or routes
[ ] Changes to authentication logic
[ ] Changes to authorization / permission checks
[ ] New or modified database queries
[ ] User input processing (form data, URL params, file uploads)
[ ] New dependencies added (check each with npm audit / pip-audit)
[ ] Environment variable / config changes
[ ] Cryptographic operations (hashing, encryption, token generation)
[ ] File system access
[ ] External HTTP requests

Only continue with checks relevant to the PR's actual attack surface.