Security Scan Diff

DevOps & Security

security-scan-diff

Security Scan Diff is an Agent Skill for devops & security published in the dyoshikawa/rulesync repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Scan for malicious code in git diff between a tag/commit and HEAD

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/dyoshikawa/rulesync/blob/HEAD/.rulesync/skills/security-scan-diff/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/security-scan-diff, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

target_ref = $ARGUMENTS

If target_ref is not provided, ask the user which tag or commit to compare against HEAD.

Overview

Thoroughly check for malicious code in the diff between ${target_ref} and the latest commit (HEAD).

Steps

Verify the target ref exists and get the diff scope.
- Run git log ${target_ref}..HEAD --oneline to list commits.
- Run git diff ${target_ref}..HEAD --stat to get file change statistics.
- Categorize changed files into: CI/CD workflows, source code, and config/docs.
Execute the following security reviews in parallel using subagents:
- Call security-reviewer subagent to review CI/CD and workflow files (.github/, scripts/) for:
  - Secret exfiltration
  - Script injection (${{ github.event.* }} direct expansion in run:)
  - Suspicious external URLs/API connections
  - Privilege escalation or token misuse
  - Malicious command execution (curl | bash, eval, base64 decode execution)
  - Supply chain attack patterns (suspicious npm packages, unsigned action references)
  - Dangerous pull_request_target usage
- Call security-reviewer subagent to review source code files (src/) for:
  - Arbitrary code execution (eval, Function constructor, suspicious child_process usage)
  - Path traversal (../.. directory escape)
  - Command injection (user input passed directly to shell commands)
  - Suspicious external communication (fetch, http.request, axios to external URLs)
  - Unauthorized filesystem operations
  - Credential/token leakage (hardcoded tokens, logging sensitive values)
  - Dependency tampering (suspicious package.json changes)
  - Backdoor patterns (obfuscated code, suspicious conditionals, hidden functionality)
  - Prototype pollution and deserialization vulnerabilities
  - Supply chain attacks (suspicious new dependency packages)
- Call security-reviewer subagent to review config and documentation files for:
  - Suspicious dependencies or scripts in package.json
  - Suspicious registries or URLs in lockfiles
  - Security rule relaxation in config schemas or linter configs
  - Suspicious settings in devcontainer or editor configs
  - Phishing URLs in documentation
  - Malicious instructions in AI rule/subagent/skill definitions

Integrate the results from all subagents and produce a unified report in the following format:

## Security Review Report: ${target_ref} -> HEAD

### Conclusion
- Whether malicious code was detected or not

### Check Results Summary Table
| Check Item | Result |
|------------|--------|
| ... | ... |

### Findings (if any)
| Severity | Description | File | Risk |
|----------|-------------|------|------|
| ... | ... | ... | ... |

### Recommendations (if any)
- Actionable recommendations for each finding

### Positive Observations
- Good security practices found in the diff