---
name: diff-risk-spot-check
description: Quickly inspect a code diff for the failure modes most likely to hurt users.
---

# Diff Risk Spot Check

## Use this skill when

- The user wants a fast, focused review of a branch, commit, patch, or pull request.
- A full repository audit would be disproportionate to the change.

## Workflow

1. Read repository guidance and identify the base/head diff.
2. Classify changed surfaces: authentication, authorization, money, personal data, destructive operations, migrations, API contracts, concurrency, and deployment.
3. Trace each high-risk input through validation, policy, persistence, side effects, and error handling.
4. Check whether the tests exercise realistic user-visible failures rather than implementation trivia.
5. Run the narrowest relevant tests or checks that are safe and available.
6. Report only actionable findings, ordered by severity, with file/line evidence and a concrete failure scenario.

## Guardrails

- Do not invent a defect to make the review look useful.
- Do not expose secrets or personal data in the review.
- Do not modify code unless the user asks for a fix.
- If no material issue is found, state what was checked and what remains uncertain.

## Completion standard

The user receives severity-ordered findings, verification results, and a short residual-risk note.