| name | git-forensics-scanner |
| description | Git diff forensics for surfacing and classifying code changes for trojan detection |
| allowed-tools | ["Bash","Read","Glob","Grep"] |
| graph | {"domains":["domain:security"],"specializations":["specialization:security-compliance"],"skillAreas":["skill-area:incident-response-forensics","skill-area:sast"],"roles":["role:security-engineer","role:compliance-engineer"],"workflows":["workflow:security-audit","workflow:vulnerability-management"]} |
Git Forensics Scanner
Surfaces and classifies all code changes in a repository using git diff analysis, providing structured change sets for downstream semantic analysis.
Purpose
The first phase of nation-state trojan detection: identify exactly what changed, how much changed, and classify each change by risk level. Small diffs in critical code paths are flagged as highest-risk since business-logic trojans typically modify 1-5 lines.
Capabilities
Change Set Extraction
- Unstaged changes (
git diff)
- Staged changes (
git diff --cached)
- Commit range diffs (
git diff <base>..<head>)
- Branch diffs (
git diff <base>...<head>)
- Per-file patch extraction with full hunk context
Change Classification
- code — Logic, algorithms, formulas, control flow
- config — Constants, parameters, thresholds, defaults