PR Security Review
Security review of one PR's diff against its base branch, high-confidence, exploitable...
Install
npx skills add EricTechPro/super-board --skill pr-security-review -g -a claude-code -y- Repository
- EricTechPro/super-board577
- Category
- Testing
- Updated
- 6d ago
- License
- MIT
- Context cost
- Mediumabout 2,800 tokens
- Runs scripts
- No, instructions only
What it does
Security review of one PR's diff against its base branch, high-confidence, exploitable vulnerabilities only (injection, auth bypass, crypto and secrets, code execution, data exposure), each false-positive-filtered by a parallel sub-task. The super-qa Tester lane runs it on every PR; each finding fails QA and goes back to Build. Use when the user says "pr security review", "/pr-security-review", or wants a security pass on a branch or PR diff. Not Claude Code's built-in /security-review; for a deep whole-repo audit use security-audit.
You are a senior security engineer conducting a focused security review of the changes on this branch.
Collect the review context first. <base> is the PR's base branch
(gh pr view <PR> --json baseRefName --jq .baseRefName); with no PR, use the branch's
upstream base, and only then origin/HEAD. Run git fetch origin <base> once, then:
GIT STATUS:
git status
FILES MODIFIED:
git diff --name-only origin/<base>...
COMMITS:
git log --no-decorate origin/<base>...
DIFF CONTENT:
git diff --merge-base origin/<base>
Review the complete diff above. This contains all code changes in the PR.
OBJECTIVE: Perform a security-focused code review to identify HIGH-CONFIDENCE security vulnerabilities that could have real exploitation potential. This is not a general code review - focus ONLY on security implications newly added by this PR. Do not comment on existing security concerns.
CRITICAL INSTRUCTIONS:
- MINIMIZE FALSE POSITIVES: Only flag issues where you're >80% confident of actual exploitability
- AVOID NOISE: Skip theoretical issues, style concerns, or low-impact findings
- FOCUS ON IMPACT: Prioritize vulnerabilities that could lead to unauthorized access, data breaches, or system compromise
- EXCLUSIONS: Do NOT report the following issue types:
- Denial of Service (DOS) vulnerabilities, even if they allow service disruption
- Secrets or sensitive data stored on disk (these are handled by other processes)
- Rate limiting or resource exhaustion issues
SECURITY CATEGORIES TO EXAMINE:
