# concurrency-correctness

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock, lock-free atomics use the wrong memory ordering, or double-checked locking is missing the necessary barrier. Use when writing or modifying code that acquires multiple locks, uses atomic operations with explicit memory orders (std::memory\_order\_\*, atomic.LoadAcquire, Ordering::Relaxed), implements lazy initialization with double-checked locking, or calls a blocking operation (I/O, sleep, await, blocking channel send) inside a locked region.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/concurrency-correctness ~/.claude/skills/concurrency-correctness
```

## From README

Concurrency Correctness (CWE-833, CWE-820, CWE-667) What this checks Concurrency bugs that read clean in isolation but produce deadlocks, lost wakeups, or data races in production. Race detectors catch triggered races but not structural mistakes. Flags local patterns: lock-around-blocking-call, lock-order in nested acquires, atomic memory order, double-checked locking. Not a replacement for whole-program ownership analysis (borrow checker, lockdep, model checking).

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [contract-review](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/contract-review/index.md) — Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars