Perform Differential Security Code Reviews

Differential Security Review is a security-focused code review process for PRs, commits, and diffs - distinct from a general code review - built around five principles: risk-first prioritization (auth, crypto, value transfer, external calls), evidence-based findings backed by git history, line numbers, and attack scenarios, adaptive depth scaled to codebase size, honesty about coverage limits and confidence, and an always-generated markdown report artifact. It runs a seven-stage workflow: Pre-Analysis, Phase 0 Triage, Phase 1 Code Analysis, Phase 2 Test Coverage, Phase 3 Blast Radius, Phase 4 Deep Context, Phase 5 Adversarial modeling, and Phase 6 Report.

Use it when a change touches auth, crypto, external calls, value transfer, permissions, or other high-risk logic and needs evidence-backed findings rather than a general review. It scales its depth to codebase size - DEEP (reading all dependencies, full git blame) under 20 files, FOCUSED (1-hop dependencies, priority files) at 20-200 files, SURGICAL (critical paths only) above 200 - and risk-classifies files as HIGH (auth, crypto, external calls, value transfer, validation removal), MEDIUM (business logic, state changes, new public APIs), or LOW (comments, tests, UI, logging). It is explicitly not for greenfield code with no baseline to compare, documentation-only or formatting/linting changes, or when the user explicitly accepts the risk of a quick summary only - those cases call for standard code review instead. Seven named rationalizations are flagged as traps to reject outright, including treating small PRs as automatically low-risk (Heartbleed was two lines) and skipping git history because it "takes too long."

Input: a PR, commit range, or diff, classified by risk rather than size. Output: a markdown report file, never chat-only, whose findings are backed by specific line numbers, commit references, and concrete rather than generic attack scenarios, gated by a quality checklist - every changed file analyzed, git blame run on removed security code, blast radius calculated for HIGH-risk changes, and the user notified with a summary. Five named red flags trigger immediate escalation to adversarial analysis even during a quick triage: code removed from a commit mentioning security, CVE, or fix; an access-control modifier removed, such as onlyOwner or a method going from internal to external; validation removed with no replacement; an external call added without checks; or a HIGH-risk change with 50+ callers in its blast radius. Worked examples span a 30-minute quick triage on a 5-file PR, a 3-4 hour standard review on an 80-file codebase, and a 6-8 hour deep audit on a 450-file auth-system rewrite.

Composes with audit-context-building for pre-analysis baseline context and deep context on HIGH-risk changes, and hands its report to issue-writer (issue-writer --input DIFFERENTIAL_REVIEW_REPORT.md --format audit-report) to produce a formal audit report. Four supporting documents carry the depth: methodology.md (Phases 0-4), adversarial.md (Phase 5 attacker modeling), reporting.md (Phase 6 report structure), and patterns.md, a vulnerability-pattern reference.

Security reviewers and engineers who need a rigorous, evidence-backed review of a specific PR or diff - especially one touching authentication, cryptography, or value transfer - with a documented, artifact-producing process rather than an ad hoc read-through.