メニュー
Security-focused review of code diffs and PRs with surface classification and Semgrep on changed files. Use when reviewing pull requests, branch diffs, or validating security regressions before merge.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Orchestrate continual learning by delegating transcript mining and AGENTS.md updates to the knowledge-synthesizer subagent. Use when asked to mine prior chats, maintain AGENTS.md, update learned preferences, or run the continual-learning loop.
Live Notion session log (L4b) — create, incremental updates during work, finalize on CLOSE. Works on any Cursor project workspace.
Bootstrap a new project with Cursor-ready configuration: AGENTS.md, per-project .cursor/rules/project-conventions.mdc, and optional memory_bank/ scaffold. Use at project initialization, when starting a new repo, or when the user says "set up Cursor for this project" / "bootstrap this project" / "init project config".
Phase-1 repo reconnaissance as a standalone skill: stack detection, relevant files, validation commands from repo evidence, workflow hints, and risk flags. Use inside /scout, /ks-conductor pre-flight, or any read-only discovery before planning or implementation.
Validates phase outputs before advancing the SDLC. Defines expected artifacts per phase (intake, scout, plan, critic, build, test, review, document, close) and produces a clear PASS / CONDITIONAL / BLOCK verdict with gaps. Use at orchestrator or command phase boundaries, before expensive work, or when the user asks to verify a gate or "are we ready to proceed".
Runs Semgrep static analysis security audits with scoped rulesets and structured findings. Use for security scans, vulnerability audits, or when touching auth, secrets, SQL, or user input boundaries.
| name | differential-review |
| description | Security-focused review of code diffs and PRs with surface classification and Semgrep on changed files. Use when reviewing pull requests, branch diffs, or validating security regressions before merge. |
On-demand loading: Read this skill only when reviewing diffs or PRs for security impact. Do not load for unrelated work.
Related: Full audit → security-review. Staff gate → tech-lead-review. Pre-done smoke → review-and-secure.
Use this skill to perform a security-focused review of code changes (diffs). Invoke when reviewing pull requests, auditing a feature branch, or validating that a changeset does not introduce security regressions.
Get the changeset to review via one of:
# Current working tree vs HEAD
git diff HEAD
# A specific branch vs main
git diff main...feature-branch
# A specific commit range
git diff <base-sha>..<head-sha>
# Staged changes only
git diff --cached
Or use the user-github MCP to fetch a PR diff directly.
For each changed file, classify the security surface using the table in references/review-surfaces.md.
For each high/critical surface change, apply the checklist from references/review-surfaces.md covering: Authentication & Authorization, Injection, Secrets & Credentials, Data Exposure, Dependencies, and Logic & Business Rules.
For changed files, run Semgrep on just the diff scope:
# Get list of changed files
CHANGED=$(git diff --name-only HEAD)
# Run semgrep on changed files only
semgrep --config p/security-audit --config p/secrets $CHANGED
Or invoke the semgrep-audit skill on the changed file set.
Structure the report as:
## Differential Security Review
**Base:** <base ref>
**Head:** <head ref>
**Changed files:** N
**Security-relevant surfaces touched:** <list>
---
### Critical Issues (must fix before merge)
...
### High Issues (should fix before merge)
...
### Medium Issues (fix in follow-up)
...
### Positive Security Changes
(changes that improve security posture)
...
### Verdict
- [ ] **APPROVED** — no security concerns found
- [ ] **APPROVED WITH CONDITIONS** — minor issues to address
- [ ] **NEEDS CHANGES** — significant issues require remediation
- [ ] **BLOCKED** — critical security issues found
methodology.md, adversarial.md, cognitive-biases.md) documents an adversarial review mindset not included here.