mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
Lixin2026
d5fe2e6a78
* feat(codex): add skill UI metadata * Use official Trail of Bits logo * fix: resolve code review findings for PR #175 Codex silently drops the icons as authored: its loader (codex-rs/core-skills resolve_asset_path) requires icon paths containing '..' to resolve under <plugin_root>/assets/, and the repo-root .codex/assets location fails that containment check. Verified empirically via codex app-server plugin/read: every iconSmall/iconLarge came back null; only brand_color applied. P1 fixed: - Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for all 38 plugins with skills and point every openai.yaml at ../../assets/trail-of-bits-mark.svg (the supported plugin-level shared asset pattern). Icons now resolve for marketplace installs too, since nothing escapes the plugin root. - Drop the .codex/ additions: .codex/skills/gh-cli/agents/ openai.yaml resolved nowhere (.codex/skills is not a Codex discovery root) and PR #173 removes the whole .codex/ tree P2 fixed: - Patch-bump all 38 touched plugins in plugin.json and marketplace.json so installed clients pick up the metadata Verified: - Static check replicating Codex's resolution algorithm: all 73 yaml files resolve under their plugin assets/ and exist - Live codex app-server probe: 71/72 loadable skills report resolved iconSmall/iconLarge and brand_color #D83A34 (claude-in-chrome-troubleshooting fails to load on main due to a pre-existing 64-char qualified-name limit, fixed by #173's rename; zeroize-audit's manifest mcpServers object is likewise a pre-existing Codex incompatibility fixed by #173) - validate_codex_skills.py, validate_plugin_metadata.py, prek all pass Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(codex): use skill-local icon assets --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Differential Review
Security-focused differential review of code changes with git history analysis and blast radius estimation.
Author: Omar Inuwa
When to Use
Use this skill when you need to:
- Review PRs, commits, or diffs for security vulnerabilities
- Detect security regressions (re-introduced vulnerabilities)
- Analyze the blast radius of code changes
- Check test coverage gaps for modified code
What It Does
This skill performs comprehensive security review of code changes:
- Risk-First Analysis - Prioritizes auth, crypto, value transfer, external calls
- Git History Analysis - Uses blame to understand why code existed and detect regressions
- Blast Radius Calculation - Quantifies impact by counting callers
- Test Coverage Gaps - Identifies untested changes
- Adaptive Depth - Scales analysis based on codebase size (small/medium/large)
Installation
/plugin install trailofbits/skills/plugins/differential-review
Documentation Structure
This skill uses a modular documentation architecture for token efficiency and progressive disclosure:
Core Entry Point
- SKILL.md - Main entry point (217 lines)
- Quick reference tables for triage
- Decision tree routing to detailed docs
- Quality checklist and red flags
- Integration with other skills
Supporting Documentation
-
methodology.md - Detailed phase-by-phase workflow (~200 lines)
- Pre-Analysis: Baseline context building
- Phase 0: Intake & Triage
- Phase 1: Changed Code Analysis
- Phase 2: Test Coverage Analysis
- Phase 3: Blast Radius Analysis
- Phase 4: Deep Context Analysis
-
adversarial.md - Attacker modeling and exploit scenarios (~150 lines)
- Phase 5: Adversarial Vulnerability Analysis
- Attacker model definition (WHO/ACCESS/INTERFACE)
- Exploitability rating framework
- Complete exploit scenario templates
-
reporting.md - Report structure and formatting (~120 lines)
- Phase 6: Report Generation
- 9-section report template
- Formatting guidelines and conventions
- File naming and notification templates
-
patterns.md - Common vulnerability patterns (~80 lines)
- Security regressions detection
- Reentrancy, access control, overflow patterns
- Quick detection bash commands
Benefits of This Structure
- Token Efficient - Load only the documentation you need
- Progressive Disclosure - Quick reference for triage, detailed docs for deep analysis
- Maintainable - Each concern separated into its own file
- Navigable - Decision tree routes you to the right document
Workflow
The complete workflow spans Pre-Analysis + Phases 0-6:
- Pre-Analysis - Build baseline context with
audit-context-buildingskill (if available) - Phase 0: Intake - Extract changes, assess size, risk-score files
- Phase 1: Changed Code - Analyze diffs, git blame, check for regressions
- Phase 2: Test Coverage - Identify coverage gaps
- Phase 3: Blast Radius - Calculate impact of changes
- Phase 4: Deep Context - Five Whys root cause analysis
- Phase 5: Adversarial Analysis - Hunt vulnerabilities with attacker model
- Phase 6: Report - Generate comprehensive markdown report
Navigation: Use the decision tree in SKILL.md to jump directly to the phase you need.
Output
Generates a markdown report with:
- Executive summary with severity distribution
- Critical findings with attack scenarios and PoCs
- Test coverage analysis
- Blast radius analysis
- Historical context and regression risks
- Actionable recommendations
Example Usage
Review the security implications of this PR:
git diff main..feature/auth-changes
Related Skills
context-building- Used for baseline context analysisissue-writer- Transform findings into formal audit reports