---

name: differential-review description: Security-focused code review for PRs and diffs - risk classification, blast radius, attack scenarios.

Differential Security Review

Security-focused code review for PRs, commits, and diffs.

Core Principles

1. Risk-First: Focus on auth, crypto, value transfer, external calls
2. Evidence-Based: Every finding backed by git history, line numbers, attack scenarios
3. Adaptive: Scale to codebase size (SMALL/MEDIUM/LARGE)
4. Honest: Explicitly state coverage limits and confidence level
5. Output-Driven: Always generate comprehensive markdown report file

Codebase Size Strategy

Risk Level Triggers

Workflow Overview

CopyPre-Analysis → Phase 0: Triage → Phase 1: Code Analysis → Phase 2: Test Coverage
      ↓              ↓                    ↓                      ↓
Phase 3: Blast Radius → Phase 4: Deep Context → Phase 5: Adversarial → Phase 6: Report

Phase Summaries

Phase 0: Triage

• Classify files by risk level
• Identify HIGH risk files for deep analysis

Phase 1: Code Analysis

• Git blame on removed security code
• Analyze changes for security implications

Phase 2: Test Coverage

• Check if security-critical changes have tests
• Flag missing tests as elevated risk

Phase 3: Blast Radius

• Calculate how many callers are affected
• High blast radius + HIGH risk = immediate escalation

Phase 4: Deep Context

• For HIGH risk changes, build full context
• Trace data flow, understand invariants

Phase 5: Adversarial

• Model attacker perspective
• Develop concrete exploit scenarios
• Rate exploitability

Phase 6: Report

• Generate comprehensive markdown report
• Include all findings with file:line references

Red Flags (Stop and Investigate)

Immediate escalation triggers:

• Removed code from "security", "CVE", or "fix" commits
• Access control modifiers removed (onlyOwner, internal → external)
• Validation removed without replacement
• External calls added without checks
• High blast radius (50+ callers) + HIGH risk change

These patterns require adversarial analysis even in quick triage.

Rationalizations (Do Not Skip)

Quality Checklist

Before delivering:

• All changed files analyzed
• Git blame on removed security code
• Blast radius calculated for HIGH risk
• Attack scenarios are concrete (not generic)
• Findings reference specific line numbers + commits
• Report file generated

When NOT to Use

• Greenfield code (no baseline to compare)
• Documentation-only changes
• Formatting/linting changes
• User explicitly requests quick summary only

Attribution

Based on trailofbits/skills differential-review skill - 45+ installs.