# contract-review

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce. Designed for nightly CI, pre-release scans, or manual deep audits — runs in tens of minutes, not seconds. Surfaces bugs that single-pass OWASP review misses — caller/callee invariant gaps, trust-anchor confusion, predicate misnaming.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/contract-review ~/.claude/skills/contract-review
```

## From README

Contract Review (deep) (A04:2025) What this checks Bugs that only resolve across both sides of a contract — a helper whose body guarantees less than callers assume. security-review pattern-matches 45 OWASP/LLM categories; this exists for what that misses. Nightly CI or manual audits; not per-PR. Vulnerable patterns Deliberately none. Pattern lists bias the search; contract-audit uses one open question per hotspot — what does the caller assume that the body doesn't enforce? — and the orchestrator does not inspect code. Procedure Use the Agent tool to dispatch subagents. Don't audit yourself. Keep state in conversation memory; don't write files. Stage 0 — Threat model Dispatch one threat-modeling subagent. Keep its JSON in conversation context; thread it into every later subagent. Stage 1 — Hotspot seed Dispatch one hotspot-mapping subagent with the threat model JSON.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/contract-review/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars