What problem does it solve? Reviewing code changes for security regressions is error-prone: reviewers miss removed validation checks, re-introduced vulnerabilities, and high blast-radius changes hidden in large diffs. This Skill provides a structured, evidence-based methodology to catch security regressions before merge. ## Core Features & Use Cases - Risk-Adaptive Analysis: Classifies changes by risk level (HIGH/MEDIUM/LOW) and adapts review depth to codebase size (SMALL/MEDIUM/LARGE) so effort goes where it matters. - Git History & Blast Radius Analysis: Uses git blame and commit history to detect regressions of previous security fixes, and quantifies caller impact to prioritize findings. - Adversarial Modeling & Reporting: Builds concrete attacker models and exploit scenarios for high-risk changes, then generates a comprehensive markdown report with severity ratings and recommendations. - Use Case: A team is merging an 80-file PR that touches an authentication module. Use this Skill to triage the 12 high-risk files, run git blame on removed access-control checks, model an exploit scenario, and produce a report recommending REJECT until the authorization bypass is fixed. ## Quick Start Ask the AI to perform a differential security review of the current PR or commit range and generate a markdown report of all findings.
