differential-review

Security-focused differential code review with blast radius analysis, risk-adaptive depth (DEEP/FOCUSED/SURGICAL), git history correlation, and structured finding format. Adapted from Trail of Bits. Use when reviewing PRs, commits, or code changes for security implications.

Aller à l'installation

Dépôt: vibeeval/vibecosystem
Dernière activité de la source: 30 mars 2026 à 16:10
Langue détectée de SKILL.md: anglais
Étoiles: 526
Forks: 45

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Retour à la recherche Retour à l’installation

name	differential-review
description	Security-focused differential code review with blast radius analysis, risk-adaptive depth (DEEP/FOCUSED/SURGICAL), git history correlation, and structured finding format. Adapted from Trail of Bits. Use when reviewing PRs, commits, or code changes for security implications.

Differential Review

Security-focused code review that adapts depth to codebase size and change risk. Goes beyond style -- finds vulnerabilities, logic errors, and blast radius.

Review Depth Modes

DEEP (Small codebase, < 5K lines changed)

Line-by-line analysis of every changed file
Full control flow tracing through changed paths
Cross-reference every function call to its definition
Check all error paths and edge cases

FOCUSED (Medium codebase, 5K-50K lines)

Prioritize files touching auth, crypto, input parsing, state mutation
Trace data flow from inputs to outputs through changed code
Skip cosmetic changes (formatting, comments, renames)
Deep-dive only on security-sensitive paths

SURGICAL (Large codebase, > 50K lines)

Review only the diff, not surrounding code
Focus exclusively on: new attack surface, removed security controls, changed trust boundaries
Flag anything that needs a separate deep review

Review Process

Phase 1: Blast Radius Assessment

Before reading any code:

# What changed?
git diff --stat <base>...<head>

# How much changed?
git diff --shortstat <base>...<head>

# Which files are security-sensitive?
git diff --name-only <base>...<head> | grep -iE

# How often has this file been changed? (churn = risk)
git log --oneline --follow <file> | wc -l

# Were there recent security fixes in this area?
git log --oneline --grep="fix\|vuln\|security\|CVE" -- <file>

# Who else has touched this code?
git log --format='%an' -- <file> | sort | uniq -c | sort -rn

## [SEVERITY] Finding Title

**Location**: file.ts:42-58
**Category**: [Input Validation | Auth | Crypto | Data Flow | State | Logic]
**Confidence**: [HIGH | MEDIUM | LOW]

**Description**:
What the vulnerability is, in one paragraph.

**Impact**:
What an attacker can achieve by exploiting this.

**Proof**:
The specific code path or data flow that demonstrates the issue.

**Recommendation**:
Concrete fix with code example if possible.

Severity	Criteria	Examples
CRITICAL	Remote exploitation, no auth required, data breach	SQL injection, auth bypass, RCE
HIGH	Requires some access, significant impact	Privilege escalation, IDOR, stored XSS
MEDIUM	Limited impact or complex exploitation	Reflected XSS, info disclosure, CSRF
LOW	Minimal impact, defense-in-depth	Missing headers, verbose errors, weak config
INFO	Best practice, no direct vulnerability	Code quality, missing rate limit, logging gap

Rationalization	Why It's Wrong	Required Action
"It's behind auth"	Auth can be bypassed	Verify auth is enforced AND correct
"We trust this input"	Trust boundaries change	Validate at every boundary
"It's just internal"	Internal networks get compromised	Apply defense in depth
"Nobody would do that"	Attackers do unexpected things	Test the unexpected case
"We'll fix it later"	Later never comes in security	Flag it NOW with severity
"The framework handles it"	Frameworks have bypasses	Verify the framework actually applies
"It's the same as before"	Before might have been wrong too	Review the original if suspicious

[ ] Blast radius assessed (files, trust boundaries, security controls)
[ ] Git history checked for churn and past security fixes
[ ] All new inputs validated
[ ] Auth/authz applied to new endpoints/paths
[ ] Error handling doesn't leak sensitive info
[ ] No hardcoded secrets or credentials
[ ] State mutations are atomic
[ ] Crypto usage follows current best practices
[ ] Logging doesn't include sensitive data
[ ] Removed code didn't contain security controls that are now missing
[ ] Dependencies added/updated are from trusted sources
[ ] Test coverage exists for security-critical paths