commit-security-scan - SKILL.md Agent Skill

name: commit-security-scan description: Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.

This is a bundled local Bug Hunter companion skill. It is portable and self-contained: use .bug-hunter/* artifacts, never .factory/* paths.

Review changed code for security issues only. This skill is optimized for:

Resolve the scan scope from the user request:

Ensure threat-model context exists.
- Preferred artifacts:
  - .bug-hunter/threat-model.md
  - .bug-hunter/security-config.json
- If missing, run the bundled threat-model-generation skill first.
Resolve the changed-file scope.
Read the full contents of the changed source files, not just the patch.
Focus on STRIDE-oriented issues in changed code:
- Spoofing: auth/session/token mistakes
- Tampering: SQLi, XSS, path traversal, command injection, mass assignment
- Repudiation: security-sensitive actions with no auditability
- Information Disclosure: IDOR, secret exposure, verbose errors
- DoS: unbounded input, missing limits, expensive regex/queries
- Elevation of Privilege: missing authorization, role bypass, privilege escalation
Reuse Bug Hunter-native security conventions:
- findings should be compatible with .bug-hunter/findings.json
- use STRIDE + CWE labels
- include confidence scores
If the user wants only a focused security diff review, stop after the findings report. If the user wants deeper validation, hand off to the bundled vulnerability-validation skill.

Preferred outputs:

This skill is intentionally diff-scoped; it does not replace full-repository audits.
Use it as the lightweight security fast-path before invoking the broader security-review flow.