differential-review

To review code diffs for security vulnerabilities, the skill analyzes changed files in pull requests or feature branches to surface potential exposures. It classifies changed surfaces using a predefined taxonomy and applies targeted Semgrep static analysis to produce a structured security report.

Surface classification in static analysis code review is categorizing changed files using a predefined surfaces taxonomy. It helps security teams quickly assess potential vulnerabilities and misconfigurations by focusing the review only on the specific surface areas exposed by the code diff.

To run Semgrep static analysis on a git diff scope, load the changes from a pull request or feature branch. The skill applies Semgrep configuration specifically to the diff scope to identify security-relevant changes and prepare a surface-focused vulnerability assessment.

Yes, this security review skill works with pull requests, feature branches, and commits. It requires git diff inputs to analyze all changed files and produces a structured security review report suitable for PR gates or audit records.

To generate a structured security review report, you need to provide git diff inputs, a surfaces taxonomy, and Semgrep configuration. The skill uses these inputs to analyze changed files and produce a structured assessment suitable for audit records or PR gates.