# PR Security Review

Security review of one PR's diff against its base branch, high-confidence, exploitable...

- Repository: https://github.com/EricTechPro/super-board (577 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add EricTechPro/super-board --skill pr-security-review -g -a claude-code -y`
Codex: `npx skills add EricTechPro/super-board --skill pr-security-review -g -a codex -y`
Cursor: `npx skills add EricTechPro/super-board --skill pr-security-review -g -a cursor -y`
Gemini CLI: `npx skills add EricTechPro/super-board --skill pr-security-review -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add EricTechPro/super-board`

## Description

Security review of one PR's diff against its base branch, high-confidence, exploitable vulnerabilities only (injection, auth bypass, crypto and secrets, code execution, data exposure), each false-positive-filtered by a parallel sub-task. The super-qa Tester lane runs it on every PR; each finding fails QA and goes back to Build. Use when the user says "pr security review", "/pr-security-review", or wants a security pass on a branch or PR diff. Not Claude Code's built-in /security-review; for a deep whole-repo audit use security-audit.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

<!--
Ported from anthropics/claude-code-security-review, .claude/commands/security-review.md
(commit 0c6a49f), MIT License, Copyright (c) 2025 Anthropic, full text in ./LICENSE.
Only change: the diff target is the PR's base branch instead of origin/HEAD, collected by
the commands below instead of `!` shell injection. The prompt after them is verbatim.
-->

You are a senior security engineer conducting a focused security review of the changes on this branch.

Collect the review context first. `<base>` is the PR's base branch
(`gh pr view <PR> --json baseRefName --jq .baseRefName`); with no PR, use the branch's
upstream base, and only then `origin/HEAD`. Run `git fetch origin <base>` once, then:

GIT STATUS:

```
git status
```

FILES MODIFIED:

```
git diff --name-only origin/<base>...
```

COMMITS:

```
git log --no-decorate origin/<base>...
```

DIFF CONTENT:

```
git diff --merge-base origin/<base>
```

Review the complete diff above. This contains all code changes in the PR.


OBJECTIVE:
Perform a security-focused code review to identify HIGH-CONFIDENCE security vulnerabilities that could have real exploitation potential. This is not a general code review - focus ONLY on security implications newly added by this PR. Do not comment on existing security concerns.

CRITICAL INSTRUCTIONS:
1. MINIMIZE FALSE POSITIVES: Only flag issues where you're >80% confident of actual exploitability
2. AVOID NOISE: Skip theoretical issues, style concerns, or low-impact findings
3. FOCUS ON IMPACT: Prioritize vulnerabilities that could lead to unauthorized access, data breaches, or system compromise
4. EXCLUSIONS: Do NOT report the following issue types:
   - Denial of Service (DOS) vulnerabilities, even if they allow service disruption
   - Secrets or sensitive data stored on disk (these are handled by other processes)
   - Rate limiting or resource exhaustion issues

SECURITY CATEGORIES TO EXAMINE:

The rest: https://github.com/EricTechPro/super-board/blob/HEAD/skills/pr-security-review/SKILL.md