thejefflarson

thejefflarson/soundcheck

Plugin Claude Code

Plugin marketplace listing 1 plugin: soundcheck.

thejefflarson/soundcheck

Plugin Claude Code

Automated OWASP security checks — Web Top 10:2025, LLM Top 10:2025, API Security Top 10:2023.

thejefflarson/soundcheck

Agent Claude Code

Given a list of security findings, identifies chains where one finding enables another and writes a plain-English attack narrative. Invoked after vulnerability-audit and design-review have returned.

thejefflarson/soundcheck

Agent Claude Code

Audits one code hotspot for a contract mismatch — a divergence between what callers assume the hotspot guarantees and what the hotspot body actually enforces. Returns hypotheses tagged VERIFIED, REFUTED, or NEEDSMORE. Invoked once per hotspot per round by the contract-review orchestrator.

thejefflarson/soundcheck

Agent Claude Code

Audits a codebase for missing security controls — the gaps that pattern-matching auditors won't catch, like no timeout, no cost cap, no rate limit, prose-only guards. Invoked in parallel with vulnerability-audit calls.

thejefflarson/soundcheck

Agent Claude Code

Second-pass refutation filter for security-review findings. Reads each candidate finding's cited code and drops the ones with concrete refutation evidence (a guard, middleware, sanitizer, or correct API call at the cited location). Bias is toward keeping; uncertain findings pass through.

thejefflarson/soundcheck

Agent Claude Code

Finds security-sensitive code locations in a repository — the files and functions a reviewer should look at. Reads the threat model for context, then enumerates and ranks hotspots. Invoked after threat-modeling, before per-hotspot review.

thejefflarson/soundcheck

Agent Claude Code

Builds a threat model for a codebase — what it does, where it runs, which inputs are trusted, which are untrusted. Pure context for downstream subagents; does not decide which files to look at. Invoked at the start of a security review or when planning a new feature that handles user data.

thejefflarson/soundcheck

Agent Claude Code

Audits all hotspots in a single file for vulnerabilities by applying named Soundcheck skills. Returns findings in plain language a non-security developer can act on. Invoked once per file (with that file's full hotspot list).

thejefflarson/soundcheck

Hook Claude Code

Runs after a tool call finishes for Edit, Write, MultiEdit and NotebookEdit tool calls, executing record-touched-path.py. From thejefflarson/soundcheck.

thejefflarson/soundcheck

Hook Claude Code

Runs when the agent finishes a response, executing auto-review.py. From thejefflarson/soundcheck.

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code. Use when writing login flows, session management, password storage, JWT handling, MFA implementation, credential validation, or any code that authenticates users. Also invoke when implementing…

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users' resources. Use when writing code that checks authorization, enforces resource ownership, handles IDOR (object-level authorization), processes server-side requests to external URLs, or implements…

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock, lock-free atomics use the wrong memory ordering, or double-checked locking is missing the necessary barrier. Use when writing or modifying code that acquires multiple locks, uses atomic operations with…

thejefflarson/soundcheck

Skill Claude CodeCodex

Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce. Designed for nightly CI, pre-release scans, or manual deep audits — runs in tens of minutes, not seconds. Surfaces bugs that single-pass OWASP review misses — caller/callee invariant gaps, trust-anchor…

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects library-internal cryptographic correctness bugs that pattern matchers and crypto-failures skills miss — AEAD nonce reuse, ECDSA k-value reuse, length-extension on bare hashes, padding-oracle exception distinguishability, and branching on secret material. Use when writing code that calls a crypto primitive…

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects weak or broken cryptography that lets attackers recover plaintext passwords, forge tokens, or decrypt sensitive data. Use when writing code that encrypts or decrypts data, hashes passwords or tokens, generates random values for security purposes, manages cryptographic keys, or configures TLS/SSL settings. Also…

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects forms and state-changing endpoints missing CSRF protection. Use when writing HTML forms that submit POST/PUT/DELETE requests, configuring session cookies, or setting up CSRF middleware for web applications. Also invoke when disabling or bypassing CSRF protections in framework configuration.

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects error handlers that leak stack traces or fail open on exception. Use when writing error handlers, exception catching blocks, try/catch/finally constructs, or API error responses. Also invoke when an application could fail open on exception, or when stack traces might reach end users.

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects autonomous agents that take irreversible or high-impact actions without human approval. Use when building autonomous LLM agents, implementing multi-step agent pipelines, writing code where LLM output triggers real-world actions (file writes, API calls, emails, database changes, code execution), or designing…

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects file upload handlers that accept executable content or write to web- accessible paths without validation. Use when writing file upload handlers, processing multipart form data, saving uploaded files to disk or cloud storage. Also invoke when accepting user-supplied filenames or storing uploads in a…

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects GraphQL schemas without depth limits, cost analysis, or introspection controls. Use when writing GraphQL schemas, resolvers, or server configuration. Also invoke when setting up Apollo Server, graphql-yoga, Strawberry, gqlgen, or any GraphQL framework without explicit depth limiting, cost analysis, or…

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects API keys, passwords, tokens, and credentials embedded directly in source code. Use when writing code that contains API keys, passwords, tokens, connection strings, or private keys as string literals. Also invoke when embedding credentials in configuration files, environment setup scripts, or test fixtures that…

thejefflarson/soundcheck

Skill Claude CodeCodex

Detects HTTP response header construction from user input vulnerable to CRLF injection. Use when writing code that sets HTTP response headers using values from user input, request parameters, or external data. Also invoke when constructing email headers, Content-Disposition filenames, or Location headers from…