What problem does it solve? Code review often misses security issues that static rule engines cannot express, such as broken authorization, IDOR, business-flow flaws, and invariant violations. This Skill performs a fast, diff-scoped security review that produces falsifiable, inline findings a human can verify in seconds. ## Core Features & Use Cases - Diff-scoped analysis: Establishes the correct diff with git diff origin/main...HEAD (merge-base, triple-dot) and filters to added, copied, modified, and renamed files. - Prioritized review checklist: Focuses on authorization/IDOR, multi-step business flows, invariants, trust boundaries, SSRF, new dependencies, authentication changes, secrets handling, and CI workflow files. - OWASP Top 10:2025 coverage frame: Uses the 2025 list as an end-of-pass coverage check, with the API Security Top 10 cited as 2023. - Falsifiable inline output: Each finding is anchored to a file:line with severity, confidence, CWE, and a concrete exploit path; silence is a valid result when nothing security-relevant changed. - Use Case: Before merging a pull request that adds a new invoice endpoint, run this review to catch a missing tenant-ownership check and receive an inline comment citing the exact line and attack path. ## Quick Start Review the security impact of my current branch's diff against main and return inline findings with severity and confidence.
