skills.rest
openai
openaiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-diff-scan

Review pull requests, commits, and branch diffs for security vulnerabilities.

5.3k|765|Updated Mar 4, 2026
Search Tags:#Security#Threat Modeling#Vulnerability#sarif#Code review#diff scan#Pull request
One-click install
npx skills add https://github.com/openai/plugins --skill security-diff-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-diff-scan
Source: https://github.com/openai/plugins/tree/main/plugins/codex-security/skills/security-diff-scan
Command: npx skills add https://github.com/openai/plugins --skill security-diff-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Manually auditing every changed file in a pull request or branch diff for security flaws is slow and error-prone, and subtle vulnerabilities introduced by small changes are easy to miss during code review.

Core Features & Use Cases

  • Diff-Scoped Security Review: Scans every changed source file in a PR, commit, branch diff, or working-tree patch, including deleted files, without expanding into an unrelated repository audit.
  • Structured Scan Pipeline: Runs threat modeling, finding discovery, validation, and attack-path analysis as coordinated stages with recorded checkpoints and coverage tracking.
  • Report Generation: Produces a final report.md, SARIF output, findings.json, and coverage.json so results integrate with code review and security tooling.
  • Use Case: Before merging a feature branch, run the scan on the branch diff to detect injection flaws, auth bypasses, or unsafe data handling introduced by the change, then receive confirmed findings with exact locations and evidence.

Quick Start

Run a security diff scan on this pull request and report any confirmed vulnerabilities with their locations and evidence.

Frequently Asked Questions about security-diff-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a pull request for security vulnerabilities?▼

Provide the PR, commit, branch diff, or working-tree patch as the scan target. The scan resolves the exact Git range, reviews every changed file including deletions, and returns confirmed findings with locations, evidence, and a generated report.

What does a diff security scan check in changed code?▼

It runs threat modeling, finding discovery in compact diff mode, validation, and attack-path analysis on all in-scope changed files. Confirmed findings are recorded with exact locations, evidence, and affected instances.

Can I scan a local working-tree patch instead of a committed diff?▼

Yes, the scan accepts working-tree patches using local-patch diff mode. For terminal workflows, the generate_in_scope_files.py script builds the changed-file list from a specified base and head or local patch.

What output formats does the security scan produce?▼

Finalization generates a report.md file and SARIF output, along with findings.json, coverage.json, and a scan manifest. These artifacts support code review comments and integration with security tooling.

Does the diff scan audit the entire repository?▼

No, it deliberately limits scope to changed files and the supporting code needed to explain the change. Unchanged files are inspected only when required to understand the modified behavior, avoiding a full repository audit.

Related Skills

Explore More Software Engineering Skills→
theslashdojotheslashdojo

git-diff

Identify and review exact changes across git states with unified diff output.

Official
Advanced
sdcorejssdcorejs
2

sdcorejs-repair-loop

Verify, fix, and re-verify review findings until Critical and Important items resolve.

Community
Advanced
igot-aiigot-ai

security-review

Detect secrets, injection, auth, and dependency risks in code changes.

Official
Intermediate
Cogni-AI-OUCogni-AI-OU
3

security-review

Analyze pull request diffs to detect security vulnerabilities in incremental changes.

Official
Basic