differential-review

仓库创建 2026年1月15日最近提交 6 天前SkillHot 收录 20 天前

▸ 精选理由

能把变更审计自动化并给出可操作的安全建议，适合审计与代码评审流程。

这个 Skill 做什么

对 PR/提交差异进行安全优先的代码审查，生成证据链与风险评估报告。

以安全为优先对 PR/提交差异做审查，不只是看代码，还会追溯 git 历史、估算影响范围（blast radius）并检查测试覆盖率。在合并前需要防止安全回归或评估变更风险时用最合适。每个发现都有证据链和风险评估，能输出详尽的 Markdown 报告便于追踪和决策。

▸ 展开 SKILL.md 英文原文

Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.

开发编程安全审计代码差异风险评估通用

6.3k

Stars

542

Forks

仓库内 Skill

+270

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/trailofbits/skills/main/plugins/differential-review/skills/differential-review/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/trailofbits/skills/main/plugins/differential-review/skills/differential-review/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Differential Security Review

Security-focused code review for PRs, commits, and diffs.

## Core Principles

1. **Risk-First**: Focus on auth, crypto, value transfer, external calls
2. **Evidence-Based**: Every finding backed by git history, line numbers, attack scenarios
3. **Adaptive**: Scale to codebase size (SMALL/MEDIUM/LARGE)
4. **Honest**: Explicitly state coverage limits and confidence level
5. **Output-Driven**: Always generate comprehensive markdown report file

---

## Rationalizations (Do Not Skip)

| Rationalization | Why It's Wrong | Required Action |
|-----------------|----------------|-----------------|
| "Small PR, quick review" | Heartbleed was 2 lines | Classify by RISK,

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有