commit-security-scan

Analyzes changed files for vulnerabilities using predefined security models and generates reports.

Updated Feb 3, 2026

Search Tags:#security #STRIDE #LLM #code-review #threat-model #diff-scan

Ready to run

npx skills add https://github.com/IEatCodeDaily/cli-dotfiles --skill commit-security-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: commit-security-scan
Source: https://github.com/IEatCodeDaily/cli-dotfiles/tree/main/configs/factory-cli/skills/commit-security-scan
Command: npx skills add https://github.com/IEatCodeDaily/cli-dotfiles --skill commit-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill analyzes code changes (PRs, commits, or diffs) for security vulnerabilities using large language model reasoning and a formal threat model approach, enabling safer code reviews and pre-merge checks.

Core Features & Use Cases

LLM-driven threat analysis: Detects vulnerabilities across changed files using a repository threat model and severity thresholds.
PR, pre-commit, and branch coverage: Suitable for PR reviews, pre-commit checks, and branch comparisons to enforce secure development.
Prerequisite-driven workflow: Reads and validates the threat model at .factory/threat-model.md and the security config at .factory/security-config.json, auto-generating them if needed.

Quick Start

Run the security scan on the current workspace against changed files; ensure prerequisites exist or are auto-generated, and review the structured findings.

Frequently Asked Questions about commit-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan code changes for security vulnerabilities before merging a pull request?▼

Scanning code changes for security vulnerabilities involves analyzing PRs, commits, and diffs using LLM-powered threat-model reasoning. The process applies your repository's threat model and security configuration to identify STRIDE-based vulnerabilities across changed files and reports findings in a structured format.

What is STRIDE-based threat modeling for code diffs?▼

STRIDE-based threat modeling for code diffs is an analysis mechanism that identifies security vulnerabilities in changed files. It applies the repository's threat model and security configuration to evaluate code modifications during PR reviews, pre-commit scans, or branch comparisons.

Do I need a threat model file to run a security scan on my repository?▼

Yes, the security scan requires a threat model at .factory/threat-model.md and a security config at .factory/security-config.json. If these prerequisite files are missing, the scan can auto-generate them to enable the vulnerability analysis workflow.

Can I use LLM reasoning to detect vulnerabilities during pre-commit checks?▼

Yes, you can use LLM reasoning to detect vulnerabilities during pre-commit checks. The scan evaluates code diffs and applies severity thresholds from your security configuration to enforce secure development before commits are finalized.

What's the best way to compare branches for security threats?▼

The best way to compare branches for security threats is to run a diff scan that applies your repository's threat model to the changed files. This identifies STRIDE-based vulnerabilities across the branch differences and reports findings in a structured format.