What problem does it solve? Code changes often introduce security regressions that slip through casual review, especially when removed validation, altered access controls, or new external calls go unnoticed. This Skill provides a structured, evidence-based methodology for reviewing diffs so that high-risk changes are caught before merge. ## Core Features & Use Cases - Risk-Adaptive Analysis: Classifies changes by risk level (HIGH/MEDIUM/LOW) and scales review depth to codebase size (SMALL/MEDIUM/LARGE). - Git History & Blast Radius: Uses git blame to investigate removed security code and quantitatively calculates how many callers a change affects. - Adversarial Modeling: Builds concrete attacker models and exploit scenarios for high-risk changes, with test coverage checks and a mandatory markdown report. - Use Case: Before merging a PR that modifies authentication logic, run a differential review to detect removed validation, calculate the blast radius across callers, and produce a report with line-number-referenced findings. ## Quick Start Ask the AI to perform a differential security review of the current pull request or a specific commit range and generate the review report.
