authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code. Use when writing login flows, session management, password storage, JWT handling, MFA implementation, credential validation, or any code that authenticates users. Also invoke when implementing "remember me" functionality or API key management.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/authentication-failures" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/authentication-failures ~/.claude/skills/authentication-failuresFrom README
Authentication Failures Security Check (A07:2025) What this checks Protects identity and session integrity. Weak password storage, flawed JWT handling, and sessions that survive logout let attackers impersonate users, escalate privileges, and persist after credential rotation. Vulnerable patterns JWT verification call with a weak, short, or hardcoded signing secret JWT decode that disables signature verification or accepts the none algorithm Logout handler that does not invalidate the session or token server-side Login flow with no rate limiting or account lockout, allowing credential stuffing Password or API-key comparison using a non-constant-time equality operator For password hashing issues (MD5/SHA), see cryptographic-failures. For hardcoded API keys/passwords in source, see hardcoded-secrets. Fix immediately Flag the vulnerable code and explain the risk.
More from this repo
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
contract-review
Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce.