# Jeff Larson

> Application security review workflows

Soundcheck skills for reviewing authentication, access control, cryptography, injection risks, and application security.

## Profile stats

- Skills: 52
- Stars: 1k
- Best skill: authentication-failures

## Links

- HTML page: https://omgskills.com/library/thejefflarson/
- GitHub: https://github.com/thejefflarson

## Featured skills

- [authentication-failures](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [contract-review](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/contract-review/index.md) — Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [crypto-library-misuse](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/crypto-library-misuse/index.md) — Detects library-internal cryptographic correctness bugs that pattern matchers and crypto-failures skills miss — AEAD...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [cryptographic-failures](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/cryptographic-failures/index.md) — Detects weak or broken cryptography that lets attackers recover plaintext passwords, forge tokens, or decrypt sensitive...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [csrf](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/csrf/index.md) — Detects forms and state-changing endpoints missing CSRF protection.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [exceptional-conditions](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/exceptional-conditions/index.md) — Detects error handlers that leak stack traces or fail open on exception.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [excessive-agency](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/excessive-agency/index.md) — Detects autonomous agents that take irreversible or high-impact actions without human approval.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [file-upload](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/file-upload/index.md) — Detects file upload handlers that accept executable content or write to web- accessible paths without validation.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [graphql-security](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/graphql-security/index.md) — Detects GraphQL schemas without depth limits, cost analysis, or introspection controls.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [hardcoded-secrets](https://omgskills.com/skills/thejefflarson/soundcheck/dot-claude/skills/hardcoded-secrets/index.md) — Detects API keys, passwords, tokens, and credentials embedded directly in source code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars

## Others you might like

- [JFrog Ltd.](https://omgskills.com/library/jfrog/index.md)
- [Jim Liu / Baoyu](https://omgskills.com/library/jimliu/index.md)
- [Juliusbrussee](https://omgskills.com/library/juliusbrussee/index.md)