differential-review

Security-focused differential code review with blast radius analysis, risk-adaptive depth (DEEP/FOCUSED/SURGICAL), git history correlation, and structured finding format. Adapted from Trail of Bits. Use when reviewing PRs, commits, or code changes for security implications.

422 stars

byvibeeval

View on GitHub Installation ↓

Best use case

differential-review is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

Teams using differential-review should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

You only need a quick one-off answer and do not need a reusable workflow.
You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/differential-review/SKILL.md --create-dirs "https://raw.githubusercontent.com/vibeeval/vibecosystem/main/skills/differential-review/SKILL.md"

Manual Installation

Download SKILL.md from GitHub
Place it in .claude/skills/differential-review/SKILL.md inside your project
Restart your AI agent — it will auto-discover the skill

How differential-review Compares

Feature / Agent	differential-review	Standard Approach
Platform Support	Not specified	Limited / Varies
Context Awareness	High	Baseline
Installation Complexity	Unknown	N/A

Frequently Asked Questions

What does this skill do?

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

Related Guides

AI Agents for Coding

Browse AI agent skills for coding, debugging, testing, refactoring, code review, and developer workflows across Claude, Cursor, and Codex.

Best AI Skills for Claude

Explore the best AI skills for Claude and Claude Code across coding, research, workflow automation, documentation, and agent operations.

Cursor vs Codex for AI Workflows

Compare Cursor and Codex for AI coding workflows, repository assistance, debugging, refactoring, and reusable developer skills.

SKILL.md Source

# Differential Review

Security-focused code review that adapts depth to codebase size and change risk. Goes beyond style -- finds vulnerabilities, logic errors, and blast radius.

## Review Depth Modes

### DEEP (Small codebase, < 5K lines changed)
- Line-by-line analysis of every changed file
- Full control flow tracing through changed paths
- Cross-reference every function call to its definition
- Check all error paths and edge cases

### FOCUSED (Medium codebase, 5K-50K lines)
- Prioritize files touching auth, crypto, input parsing, state mutation
- Trace data flow from inputs to outputs through changed code
- Skip cosmetic changes (formatting, comments, renames)
- Deep-dive only on security-sensitive paths

### SURGICAL (Large codebase, > 50K lines)
- Review only the diff, not surrounding code
- Focus exclusively on: new attack surface, removed security controls, changed trust boundaries
- Flag anything that needs a separate deep review

## Review Process

### Phase 1: Blast Radius Assessment
Before reading any code:

```bash
# What changed?
git diff --stat <base>...<head>

# How much changed?
git diff --shortstat <base>...<head>

# Which files are security-sensitive?
git diff --name-only <base>...<head> | grep -iE '(auth|crypto|token|secret|permission|middleware|validator|sanitiz)'
```

Classify the change:
- **Surface area**: How many files, functions, modules touched?
- **Trust boundary crossing**: Does data flow between trust levels?
- **Security control modification**: Are auth/authz/validation/crypto paths changed?
- **Data model change**: Are schemas, types, or storage formats modified?

### Phase 2: Git History Correlation
Check if the changed code has a history of bugs:

```bash
# How often has this file been changed? (churn = risk)
git log --oneline --follow <file> | wc -l

# Were there recent security fixes in this area?
git log --oneline --grep="fix\|vuln\|security\|CVE" -- <file>

# Who else has touched this code?
git log --format='%an' -- <file> | sort | uniq -c | sort -rn
```

High churn + security fix history = increase review depth.

### Phase 3: Structured Review

For each changed file, analyze in this order:

1. **Input validation**: Are new inputs validated? Are existing validations preserved?
2. **Authentication/Authorization**: Do access controls apply to new code paths?
3. **Data flow**: Can untrusted data reach sensitive operations?
4. **Error handling**: Do error paths leak information or skip cleanup?
5. **State mutation**: Are state changes atomic? Race conditions possible?
6. **Crypto usage**: Correct algorithms, key sizes, modes, IVs?
7. **Logging**: Are sensitive values logged? Are security events NOT logged?

## Finding Format

```
## [SEVERITY] Finding Title

**Location**: file.ts:42-58
**Category**: [Input Validation | Auth | Crypto | Data Flow | State | Logic]
**Confidence**: [HIGH | MEDIUM | LOW]

**Description**:
What the vulnerability is, in one paragraph.

**Impact**:
What an attacker can achieve by exploiting this.

**Proof**:
The specific code path or data flow that demonstrates the issue.

**Recommendation**:
Concrete fix with code example if possible.
```

## Severity Classification

| Severity | Criteria | Examples |
|----------|----------|---------|
| CRITICAL | Remote exploitation, no auth required, data breach | SQL injection, auth bypass, RCE |
| HIGH | Requires some access, significant impact | Privilege escalation, IDOR, stored XSS |
| MEDIUM | Limited impact or complex exploitation | Reflected XSS, info disclosure, CSRF |
| LOW | Minimal impact, defense-in-depth | Missing headers, verbose errors, weak config |
| INFO | Best practice, no direct vulnerability | Code quality, missing rate limit, logging gap |

## Rationalizations to Reject

Common excuses that lead to missed findings. Do NOT accept these:

| Rationalization | Why It's Wrong | Required Action |
|----------------|---------------|-----------------|
| "It's behind auth" | Auth can be bypassed | Verify auth is enforced AND correct |
| "We trust this input" | Trust boundaries change | Validate at every boundary |
| "It's just internal" | Internal networks get compromised | Apply defense in depth |
| "Nobody would do that" | Attackers do unexpected things | Test the unexpected case |
| "We'll fix it later" | Later never comes in security | Flag it NOW with severity |
| "The framework handles it" | Frameworks have bypasses | Verify the framework actually applies |
| "It's the same as before" | Before might have been wrong too | Review the original if suspicious |

## Anti-Hallucination Rules

- **Never say "It probably..."** -- say "Unclear; need to inspect X"
- **Never assume a function is safe** without reading its implementation
- **Never skip a finding** because it seems minor -- document everything
- **Every claim must reference a specific file and line number**
- **If you haven't read the code, say so** -- don't infer behavior from names

## Diff Review Checklist

```
[ ] Blast radius assessed (files, trust boundaries, security controls)
[ ] Git history checked for churn and past security fixes
[ ] All new inputs validated
[ ] Auth/authz applied to new endpoints/paths
[ ] Error handling doesn't leak sensitive info
[ ] No hardcoded secrets or credentials
[ ] State mutations are atomic
[ ] Crypto usage follows current best practices
[ ] Logging doesn't include sensitive data
[ ] Removed code didn't contain security controls that are now missing
[ ] Dependencies added/updated are from trusted sources
[ ] Test coverage exists for security-critical paths
```

## Integration with vibecosystem

- **code-reviewer agent**: Use this skill for security-focused review depth
- **security-reviewer agent**: Primary consumer of this skill
- **coroner agent**: Use blast radius analysis for post-mortem propagation
- **/review skill**: Automatically applies differential review to PRs

Inspired by [Trail of Bits](https://github.com/trailofbits/skills) differential-review plugin.

Related Skills

security-review

422

from vibeeval/vibecosystem

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

review

422

from vibeeval/vibecosystem

Comprehensive code review workflow - parallel specialized reviews → synthesis

diff-review-strategy

422

from vibeeval/vibecosystem

PR size-based review depth, performance review checklist, architecture conformance checks, and framework-specific review patterns.

workflow-router

422

from vibeeval/vibecosystem

Goal-based workflow orchestration - routes tasks to specialist agents based on user goals

wiring

422

from vibeeval/vibecosystem

Wiring Verification

websocket-patterns

422

from vibeeval/vibecosystem

Connection management, room patterns, reconnection strategies, message buffering, and binary protocol design.

visual-verdict

422

from vibeeval/vibecosystem

Screenshot comparison QA for frontend development. Takes a screenshot of the current implementation, scores it across multiple visual dimensions, and returns a structured PASS/REVISE/FAIL verdict with concrete fixes. Use when implementing UI from a design reference or verifying visual correctness.

verification-loop

422

from vibeeval/vibecosystem

Comprehensive verification system covering build, types, lint, tests, security, and diff review before a PR.

vector-db-patterns

422

from vibeeval/vibecosystem

Embedding strategies, ANN algorithms, hybrid search, RAG chunking strategies, and reranking for semantic search and retrieval.

variant-analysis

422

from vibeeval/vibecosystem

Find similar vulnerabilities across a codebase after discovering one instance. Uses pattern matching, AST search, Semgrep/CodeQL queries, and manual tracing to propagate findings. Adapted from Trail of Bits. Use after finding a bug to check if the same pattern exists elsewhere.

validate-agent

422

from vibeeval/vibecosystem

Validation agent that validates plan tech choices against current best practices

tracing-patterns

422

from vibeeval/vibecosystem

OpenTelemetry setup, span context propagation, sampling strategies, Jaeger queries