security-scan-diff
Scan for malicious code in git diff between a tag/commit and HEAD
Profile →npx skills add dyoshikawa/rulesync --skill security-scan-diff --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
target_ref = $ARGUMENTS If target_ref is not provided, ask the user which tag or commit to compare against HEAD. ## Overview Thoroughly check for malicious code in the diff between `${target_ref}` and the latest commit (HEAD). ## Steps 1. Verify the target ref exists and get the diff scope. - Run `git log ${target_ref}..HEAD --oneline` to list commits. - Run `git diff ${target_ref}..HEAD --stat` to get file change statistics. - Categorize changed files into: CI/CD workflows, source code, and config/docs. 2. Execute the following security reviews in parallel using subagents: - Call security-reviewer subagent to review CI/CD and workflow files (`.github/`, `scripts/`) for: - Secret exfiltration - Script injection (`${{ github.event.* }}` direct expansion in `run:`) - Suspicious external URLs/API connections - Privilege escalation or token misuse - Malicious command execution (`curl | bash`, `eval`, base64 decode execution) - Supply chain attack patterns (suspicious npm packages, unsigned action references) - Dangerous `pull_request_target` usage - Call security-reviewer subagent to review source code files (`src/`) for: - Arbitrary code execution (`eval`, `Function` constructor, susp
- Overview
- Steps
What does the security-scan-diff skill do?
Scan for malicious code in git diff between a tag/commit and HEAD
How do I install it?
Run `npx skills add dyoshikawa/rulesync --skill security-scan-diff --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From dyoshikawa/rulesync, a repository with 1,285 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.