# Security Diff Review

> Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

- Skill: `mesteriis/security-diff-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add mesteriis/security-diff-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mesteriis/security-diff-review/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: Mesteriis (https://skillmd.com/u/mesteriis)
- Updated: 2026-08-19
- Page: https://skillmd.com/skills/mesteriis/security-diff-review

---


# Security Diff Review

Run a diff-scoped security review.

## Workflow

1. If `security-diff-scan` from Codex Security is available, read and follow it.
2. Otherwise resolve the exact diff and review changed files plus directly
   supporting code.
3. Build a narrow threat model for touched assets and trust boundaries.
4. Discover plausible findings.
5. Validate each finding with code evidence or mark it unvalidated.
6. Report severity, exploit path, confidence, remediation, and proof gaps.

## Focus

- authentication and authorization
- tenant isolation and ownership checks
- input validation and parsers
- filesystem paths and archive handling
- network calls, SSRF, redirects, webhooks
- secrets, config defaults, logs
- dependency and CI/CD changes

## Rules

- Authorized code only.
- Review-only by default; do not edit files.
- Do not claim exploitability without evidence.
- Route concrete fixes to `fix-security-finding`.