agentleFS
Sign inStart free
kenhuanguskenhuangus/defense-factory-skills/skills/security-diff-scan/SKILL.md

security-diff-scan

Skill2 starsChanged 47 days agoMITView on GitHub

Performs change-scoped defensive discovery on a diff or PR for the Defense Factory Discovery phase. Use on pull requests or local uncommitted changes instead of a full-fleet scan.

We split this skill into the rules it gives an agent

4 rules. About 0 are common, 3 are distinctive, and 1 is very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈3

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Run targeted defensive tools on changed packages/files only when available.

    line 32
  2. Very specific:

    Write .defense-factory/findings/candidates/_diff-scan-<pr-or-sha>.md summarizing scope and residual risk (unreviewed areas).

    line 37
  3. Distinctive:

    Do not mark findings validated.

    line 50
  4. Distinctive:

    If the diff touches systems outside authorization, stop and ask for scope clarification.

    line 51

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

security-diff-scan

Phase: Discovery
Style: Blue (defensive)

When to use

  • User points at a PR, branch diff, or local changes
  • Faster path than security-scan for incremental review

Preconditions

  1. Authorization for the repository under review.
  2. SECURITY.md present.
  3. Ability to obtain the diff (git diff, gh pr diff, etc.).

Procedure

  1. Determine base and head (e.g. main...HEAD).
  2. List changed paths; map to inventory asset_ids when possible.
  3. Review the diff for:
    • AuthZ/AuthN bypass patterns
    • Injection sinks with new untrusted input
    • New secrets or credentials
    • Dangerous default configs
    • Dependency upgrades with known issues
  4. Run targeted defensive tools on changed packages/files only when available.
  5. Emit candidate findings to .defense-factory/findings/candidates/ with:
    • source_skill: security-diff-scan
    • location.path set to changed files
    • Tag diff-scan and optional pr_url
  6. Write .defense-factory/findings/candidates/_diff-scan-<pr-or-sha>.md summarizing scope and residual risk (unreviewed areas).
  7. Validate JSON with scripts/validate_artifacts.py.

Required outputs

PathNotes
.defense-factory/findings/candidates/*.jsonCandidates only
.defense-factory/findings/candidates/_diff-scan-*.mdScope report

Stop / refuse

  • Same authorization rules as security-scan.
  • Do not mark findings validated.
  • If the diff touches systems outside authorization, stop and ask for scope clarification.

Next phase

triage-validate-finding for candidates that need dynamic proof; then dedupe-findings.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free