npx skills add https://github.com/trailofbits/skills --skill fix-review通过差异分析验证提交是否解决了安全发现且未引入新缺陷。
| 错误理由 | 为何错误 | 必需行动 |
|---|---|---|
| "提交信息说它修复了 TOB-XXX" | 信息可能不实;代码才是真相 | 验证实际的代码变更是否解决了该发现项 |
| "小修复,不可能引入新缺陷" | 小变更也可能导致大问题 | 分析所有变更以查找反模式 |
| "我会检查重要的发现项" | 所有发现项都重要 | 系统地检查每一项发现 |
| "测试通过了" | 测试可能未覆盖修复内容 | 验证修复逻辑,而不仅仅是测试状态 |
| "同一位开发者,他们熟悉代码" | 熟悉可能导致盲点 |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| 对每一项变更进行全新分析 |
| 输入 | 是否必需 | 格式 |
|---|---|---|
| 源提交 | 是 | Git 提交哈希值或引用(修复前的基线) |
| 目标提交 | 是 | 一个或多个待分析的提交哈希值 |
| 安全报告 | 否 | 本地路径、URL 或 Google Drive 链接 |
| 状态 | 含义 |
|---|---|
| FIXED | 代码变更直接解决了该发现项 |
| PARTIALLY_FIXED | 部分方面已解决,其他方面仍存在 |
| NOT_ADDRESSED | 未找到相关变更 |
| CANNOT_DETERMINE | 上下文不足,无法验证 |
从用户处收集所需输入:
Source commit: [hash/ref before fixes]
Target commit: [hash/ref to analyze]
Report: [optional: path, URL, or "none"]
如果用户提供多个目标提交,则使用相同的源提交分别处理每个目标提交。
当提供安全报告时,根据格式检索:
本地文件(PDF、MD、JSON、HTML): 使用 Read 工具直接读取文件。Claude 原生支持处理 PDF。
URL: 使用 WebFetch 工具获取网页内容。
失败的 Google Drive URL: 有关使用 gdrive CLI 的 Google Drive 备用逻辑,请参阅 references/report-parsing.md。
解析报告以提取发现项:
Trail of Bits 格式:
TOB-[A-Z]+-[0-9]+ 的发现项其他格式:
findings 数组的 JSON详细的解析策略请参阅 references/report-parsing.md。
对于每个目标提交,分析提交范围:
# 获取从源提交到目标提交的提交列表
git log <source>..<target> --oneline
# 获取完整差异
git diff <source>..<target>
# 获取变更的文件
git diff <source>..<target> --name-only
对于范围内的每个提交:
references/bug-detection.md)对于报告中的每个发现项:
详细的匹配策略请参阅 references/finding-matching.md。
生成两个输出:
1. 报告文件 (FIX_REVIEW_REPORT.md):
# 修复审查报告
**源提交:** <commit>
**目标提交:** <commit>
**报告:** <path or "none">
**日期:** <date>
## 执行摘要
[简要概述:审查了 X 个发现项,修复了 Y 个,存在 Z 个问题]
## 发现项状态
| ID | 标题 | 严重性 | 状态 | 证据 |
|----|-------|----------|--------|----------|
| TOB-XXX-1 | 发现项标题 | High | FIXED | abc123 |
| TOB-XXX-2 | 另一个发现项 | Medium | NOT_ADDRESSED | - |
## 缺陷引入问题
[在变更中检测到的任何潜在缺陷或回归问题]
## 按提交分析
### 提交 abc123: "修复 withdraw() 中的重入问题"
**变更的文件:** contracts/Vault.sol
**解决的发现项:** TOB-XXX-1
**问题:** 无
[详细分析]
## 建议
[任何需要的后续行动]
2. 对话摘要:
在对话中提供简洁的摘要:
分析提交以查找安全反模式。需要关注的关键模式:
全面的检测模式和示例请参阅 references/bug-detection.md。
differential-review: 用于变更的初始安全审查(审计前)
issue-writer: 用于将发现项格式化为正式的审计报告
audit-context-building: 在分析复杂修复时用于获取深度上下文
应做:
不应做:
详细指南请查阅:
references/finding-matching.md - 将提交与发现项匹配的策略references/bug-detection.md - 全面的反模式检测references/report-parsing.md - 解析不同报告格式,Google Drive 备用方案每周安装次数
400
代码仓库
GitHub 星标数
3.9K
首次出现
Jan 19, 2026
安全审计
安装于
claude-code361
opencode313
gemini-cli299
codex286
cursor281
github-copilot246
Differential analysis to verify commits address security findings without introducing bugs.
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "The commit message says it fixes TOB-XXX" | Messages lie; code tells truth | Verify the actual code change addresses the finding |
| "Small fix, no new bugs possible" | Small changes cause big bugs | Analyze all changes for anti-patterns |
| "I'll check the important findings" | All findings matter | Systematically check every finding |
| "The tests pass" | Tests may not cover the fix | Verify fix logic, not just test status |
| "Same developer, they know the code" | Familiarity breeds blind spots | Fresh analysis of every change |
| Input | Required | Format |
|---|---|---|
| Source commit | Yes | Git commit hash or ref (baseline before fixes) |
| Target commit(s) | Yes | One or more commit hashes to analyze |
| Security report | No | Local path, URL, or Google Drive link |
| Status | Meaning |
|---|---|
| FIXED | Code change directly addresses the finding |
| PARTIALLY_FIXED | Some aspects addressed, others remain |
| NOT_ADDRESSED | No relevant changes found |
| CANNOT_DETERMINE | Insufficient context to verify |
Collect required inputs from user:
Source commit: [hash/ref before fixes]
Target commit: [hash/ref to analyze]
Report: [optional: path, URL, or "none"]
If user provides multiple target commits, process each separately with the same source.
When a security report is provided, retrieve it based on format:
Local file (PDF, MD, JSON, HTML): Read the file directly using the Read tool. Claude processes PDFs natively.
URL: Fetch web content using the WebFetch tool.
Google Drive URL that fails: See references/report-parsing.md for Google Drive fallback logic using gdrive CLI.
Parse the report to extract findings:
Trail of Bits format:
TOB-[A-Z]+-[0-9]+Other formats:
findings arraySee references/report-parsing.md for detailed parsing strategies.
For each target commit, analyze the commit range:
# Get commit list from source to target
git log <source>..<target> --oneline
# Get full diff
git diff <source>..<target>
# Get changed files
git diff <source>..<target> --name-only
For each commit in the range:
references/bug-detection.md)For each finding in the report:
Identify relevant commits - Match by:
Verify the fix - Check that:
Assign status - Based on evidence:
Document evidence - For each finding:
See references/finding-matching.md for detailed matching strategies.
Generate two outputs:
1. Report file (FIX_REVIEW_REPORT.md):
# Fix Review Report
**Source:** <commit>
**Target:** <commit>
**Report:** <path or "none">
**Date:** <date>
## Executive Summary
[Brief overview: X findings reviewed, Y fixed, Z concerns]
## Finding Status
| ID | Title | Severity | Status | Evidence |
|----|-------|----------|--------|----------|
| TOB-XXX-1 | Finding title | High | FIXED | abc123 |
| TOB-XXX-2 | Another finding | Medium | NOT_ADDRESSED | - |
## Bug Introduction Concerns
[Any potential bugs or regressions detected in the changes]
## Per-Commit Analysis
### Commit abc123: "Fix reentrancy in withdraw()"
**Files changed:** contracts/Vault.sol
**Findings addressed:** TOB-XXX-1
**Concerns:** None
[Detailed analysis]
## Recommendations
[Any follow-up actions needed]
2. Conversation summary:
Provide a concise summary in the conversation:
Analyze commits for security anti-patterns. Key patterns to watch:
See references/bug-detection.md for comprehensive detection patterns and examples.
differential-review: For initial security review of changes (before audit)
issue-writer: To format findings into formal audit reports
audit-context-building: For deep context when analyzing complex fixes
Do:
Don't:
For detailed guidance, consult:
references/finding-matching.md - Strategies for matching commits to findingsreferences/bug-detection.md - Comprehensive anti-pattern detectionreferences/report-parsing.md - Parsing different report formats, Google Drive fallbackWeekly Installs
400
Repository
GitHub Stars
3.9K
First Seen
Jan 19, 2026
Security Audits
Gen Agent Trust HubFailSocketPassSnykWarn
Installed on
claude-code361
opencode313
gemini-cli299
codex286
cursor281
github-copilot246
通过 LiteLLM 代理让 Claude Code 对接 GitHub Copilot 运行 | 高级变通方案指南
22,200 周安装
Google Ads Manager 技能:广告系列管理、关键词研究、出价优化与效果分析
311 周安装
Telegram机器人开发教程:构建AI助手、通知系统与群组自动化工具
311 周安装
AI图像生成提示词优化指南:DALL-E、Midjourney、Stable Diffusion提示工程技巧
311 周安装
AI协作头脑风暴工具 - 将想法转化为完整设计规范,支持代码模板与项目管理
311 周安装
解决 Docker 沙盒 npm 安装崩溃:sandbox-npm-install 技能详解与使用指南
311 周安装
网页设计方法论:生产级HTML/CSS构建模式与BEM命名规范
311 周安装