/security-review over an empty diff returns a clean report instead of "nothing to review"

Summary

/security-review computes its subject as the diff of the current branch against origin/HEAD and takes no arguments to pin it otherwise. When that computed diff is empty — the session is on a clean checkout of the default branch, or the branch under review has already been merged — the skill proceeds and returns a clean report, with every scoping/preamble block empty. It has reviewed zero files, but the output is indistinguishable from a genuine clean pass over real changes.

In any workflow that records review outcomes (compliance trails, review records posted to PRs, merge gates), a false clean is worse than an error: it reads as a discharged security review that never happened.

Steps to reproduce

1. In any git repo with a remote, merge a feature branch into the default branch and check out a clean default branch (git status clean, git diff origin/HEAD empty).
2. Start a Claude Code session there and run /security-review.
3. The skill runs to completion and reports a clean result. The preamble/scoping sections that normally list the changes under review are empty.

Observed in practice (2026-08-10, Claude Code 2.1.226): a post-merge re-run of /security-review for an audit record returned a clean report with every preamble block empty; the false clean was caught only because a human reviewer noticed the empty scoping blocks and corrected the subject by hand. Any post-merge or re-run review is exposed the same way.

Expected behavior

An empty computed subject should be an explicit, terminal "nothing to review" outcome — clearly distinct from a clean verdict — ideally stating what was computed (base ref, resulting file count: 0) so the caller can tell a mis-scoped invocation from a genuinely empty change set. It should never be reported in the same form as "reviewed N files, no findings."

Secondary suggestion

An optional argument to pin the subject explicitly (base branch, commit range, or file list — as /code-review accepts) would let callers avoid the mis-scope entirely; today the subject is derivable only from session/branch state, which is what makes the post-merge case silent.

Environment

• Claude Code 2.1.226, macOS (darwin)
• Repo with origin/HEAD set (so #31702 does not apply)

Related

• #54671 — same failure shape (review tool misleading on trivial/empty input) in ultrareview
• #31702 — /security-review when origin/HEAD is unset (adjacent but distinct: here origin/HEAD resolves fine and the diff is legitimately empty)
• #5268 — /security-review documentation gap; empty-diff behavior is undocumented there