What problem does it solve? Reviewing pull requests, commits, and working-tree patches for security regressions is error-prone when done ad hoc, and a scan against the wrong base silently reviews the wrong code. This Skill orchestrates a rigorous, multi-phase security review of any Git-backed change set with a sealed, machine-readable scan contract. ## Core Features & Use Cases - Phased Scan Pipeline: Runs threat modeling, finding discovery, validation, and attack-path analysis as distinct sequential phases, each with ledger receipts and completion criteria. - Precise Diff Targeting: Resolves PRs, commits, branch ranges, and local patches against pinned base/head revisions, generating deterministic review worklists from changed files. - Sealed Audit Artifacts: Produces a canonical JSON scan contract, per-finding vulnerability write-ups, a hardening portfolio, and a generated markdown report with SARIF-compatible outputs. - Use Case: Before merging a pull request that touches authentication middleware, run a diff scan to discover candidate vulnerabilities introduced by the change, validate each one, analyze attack paths, and receive a sealed report with remediation guidance. ## Quick Start Ask the assistant to run a security diff scan on the current pull request or a specific commit range in your repository.
