differential-review
Security-focused differential code review with blast radius analysis, risk-adaptive depth (DEEP/FOCUSED/SURGICAL), git history correlation, and structured finding format. Adapted from Trail of Bits. Use when reviewing PRs, commits, or code changes for security implications.
npx skills add vibeeval/vibecosystem --skill differential-review --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Differential Review Security-focused code review that adapts depth to codebase size and change risk. Goes beyond style -- finds vulnerabilities, logic errors, and blast radius. ## Review Depth Modes ### DEEP (Small codebase, < 5K lines changed) - Line-by-line analysis of every changed file - Full control flow tracing through changed paths - Cross-reference every function call to its definition - Check all error paths and edge cases ### FOCUSED (Medium codebase, 5K-50K lines) - Prioritize files touching auth, crypto, input parsing, state mutation - Trace data flow from inputs to outputs through changed code - Skip cosmetic changes (formatting, comments, renames) - Deep-dive only on security-sensitive paths ### SURGICAL (Large codebase, > 50K lines) - Review only the diff, not surrounding code - Focus exclusively on: new attack surface, removed security controls, changed trust boundaries - Flag anything that needs a separate deep review ## Review Process ### Phase 1: Blast Radius Assessment Before reading any code: ```bash # What changed? git diff --stat <base>...<head> # How much changed? git diff --shortstat <base>...<head> # Which files are security-sensitive? git diff --name-on
- Review Depth Modes
- DEEP (Small codebase, < 5K lines changed)
- FOCUSED (Medium codebase, 5K-50K lines)
- SURGICAL (Large codebase, > 50K lines)
- Review Process
- Phase 1: Blast Radius Assessment
- Phase 2: Git History Correlation
- Phase 3: Structured Review
- Finding Format
- Severity Classification
- Rationalizations to Reject
- Anti-Hallucination Rules
- Diff Review Checklist
- Integration with vibecosystem
What changed? git diff --stat <base>...<head> How much changed? git diff --shortstat <base>...<head> Which files are security-sensitive? git diff --name-only <base>...<head> | grep -iE '(auth|crypto|token|secret|permission|middleware|validator|sanitiz)' How often has this file been changed? (churn = risk) git log --oneline --follow <file> | wc -l Were there recent security fixes in this area? git log --oneline --grep="fix\|vuln\|security\|CVE" -- <file>
What does the differential-review skill do?
Security-focused differential code review with blast radius analysis, risk-adaptive depth (DEEP/FOCUSED/SURGICAL), git history correlation, and structured finding format. Adapted from Trail of Bits. Use when reviewing PRs, commits, or code changes for security implications.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill differential-review --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.