differential-review

What this skill does

Analyzes git diffs, pull request changes, and commit ranges for security regressions. Unlike a full codebase audit, this skill focuses exclusively on what changed: additions that introduce new vulnerabilities (hardcoded secrets, injection sinks, unsafe deserialization), and removals that eliminate security controls (auth checks, input validation, rate limiting). It classifies changed files by risk tier, runs targeted pattern checks on additions and deletions, cross-references dependency changes, and produces a prioritized findings list with severity.

When to use

• During pull request review when you need a security-focused lens on the diff specifically
• When a commit range is suspected of introducing a regression (e.g., after an incident or pentest finding)
• As a lightweight pre-merge gate before running a full secure-code-review
• When reviewing dependency bumps that may silently alter security behavior
• When a developer says "I only changed X" and you need to verify that claim from a security perspective

Prerequisites

• Git access to the repository (local clone or remote diff URL)
• git CLI available in the environment
• (Optional) semgrep for automated pattern matching on additions
• Read access to dependency manifests (package.json, go.mod, requirements.txt, Cargo.toml, etc.)

Inputs

Item	Description	Example
DIFF_SOURCE	Source of the diff to review	git diff main..feature/login, PR URL, patch file
BASE_REF	Base branch or commit	main, v2.3.1, abc1234
HEAD_REF	Target branch or commit	feature/auth-refactor, HEAD, def5678
REPO_PATH	Path to the local repository	/home/user/myapp
LANGUAGE	Primary language(s) in the diff	Python, TypeScript, Go

Workflow

Step 1: Obtain the diff

Choose the appropriate method based on DIFF_SOURCE:

# Commit range
git diff <BASE_REF>..<HEAD_REF>

# Staged changes only
git diff --cached

# Specific files in a range
git diff <BASE_REF>..<HEAD_REF> -- path/to/file

# Full diff with context (recommended for security review)
git diff -U5 <BASE_REF>..<HEAD_REF>

# List only changed files for triage
git diff --name-only <BASE_REF>..<HEAD_REF>

# Include commit messages for context
git log --oneline <BASE_REF>..<HEAD_REF>