Skip to content

security-diff-review

Security-only review of the committed changes on a branch, PR or MR. One finder subagent looks for exploitable vulnerabilities the change introduces, one false-positive filter subagent per finding scores it, and only findings scoring 8 or more out of 10 are kept. Repos tune exclusions and precedents in REVIEW.md at the base ref.

Plugin: code-review-skills | User-invocable

Contract

Skill Contract canonical-skill-v1

Find exploitable vulnerabilities that a committed change introduces and keep only those an independent filter scores 8 or more out of 10 under the exclusion rules.

Identity

Functions
review
Success
  • Reports each kept finding with its file, line, severity, exploit scenario and recommendation, or says plainly that none were found.
  • Says the review did not complete when the diff command is refused or the merge base is missing.

Optimization Targets

task_success judge filter.md @ aeba191
evidence_completeness judge finder.md @ aeba191

Invariants

Must Preserve
  • The finder and filters are read-only and run nothing that executes the code under review.
  • REVIEW.md overrides are read from the base ref only.
  • An exclusion rule is a veto that no other check can override.
Fixed Context
toolsBash, Read, Grep, Glob, Agent
cligit
knowledgerepository_contentpublic, task_inputtask_private, tool_outputtask_private

Traceability

Skill
skills/security-diff-review/SKILL.md
Supporting

Usage

/security-diff-review