fix-review

name	fix-review
description	Verify fix commits address security findings without introducing new bugs or regressions. Analyzes diffs for anti-patterns like removed validation, weakened access control, reduced error handling, reordered external calls, and changed integer operations. Generates structured FIX_REVIEW_REPORT with finding status tracking.
version	1.1.0
model	sonnet
invoked_by	both
user_invocable	true
tools	["Read","Bash","Grep","Glob","Write"]
args	<commit-ref|PR-number> [--findings-file <path>] [--output <report-path>]
agents	["security-architect","code-reviewer","developer"]
category	Security & Compliance
tags	["security","fix-review","audit","vulnerability","regression","diff-analysis"]
best_practices	["Always compare the fix against the original finding, not just the diff in isolation","Check for regression in adjacent code paths affected by the fix","Verify that the fix does not merely suppress the symptom while leaving the root cause","Look for anti-patterns that indicate incomplete or incorrect fixes","Track partial fixes explicitly -- they are more dangerous than unfixed findings"]
error_handling	graceful
streaming	supported
verified	true
lastVerifiedAt	2026-03-01
source	builtin
trust_score	100
provenance_sha	8295c8c9743146ad

Fix Review Skill

Security-focused fix verification skill adapted from Trail of Bits audit methodology. Analyzes commit diffs against known findings to determine whether fixes are complete, partial, or introduce new issues. Detects common anti-patterns in security fix attempts and generates structured review reports. - Commit diff analysis against known security findings - Fix completeness verification (FIXED / PARTIALLY_FIXED / NOT_ADDRESSED / CANNOT_DETERMINE) - Anti-pattern detection in fix attempts - Regression risk assessment for adjacent code paths - Structured FIX_REVIEW_REPORT generation - Multi-commit fix tracking across branches - Root cause vs symptom fix differentiation - New issue introduction detection

Overview

This skill implements Trail of Bits' fix review methodology for the agent-studio framework. When a security audit produces findings and developers commit fixes, this skill systematically verifies that each finding is properly addressed without introducing new vulnerabilities or regressions.

Source repository: https://github.com/trailofbits/skills License: CC-BY-SA-4.0 Output: Structured FIX_REVIEW_REPORT.md

When to Use

• After developers commit fixes for security audit findings
• During PR review of security-related changes
• When verifying remediation of vulnerability reports
• Before closing security findings in tracking systems
• When reviewing patches for CVE remediations
• After automated security tool findings are addressed

Iron Law

NO FINDING CLOSED WITHOUT FIX VERIFICATION

A finding is not fixed until the fix has been reviewed against the original finding description, verified to address the root cause, and confirmed not to introduce new issues.

Fix Status Categories

Status	Meaning
FIXED	Finding is fully addressed. Root cause eliminated. No regressions introduced.
PARTIALLY_FIXED	Some aspects addressed but gaps remain. More dangerous than unfixed.
NOT_ADDRESSED	Fix does not relate to the finding, or finding location unchanged.
CANNOT_DETERMINE	Insufficient context or code complexity prevents definitive assessment.
NEW_ISSUE	Fix introduces a new vulnerability or regression.