hotspots
Maps security-sensitive code locations in a codebase to focus review effort. Use when the user asks to identify security-sensitive areas in a codebase, map the attack surface, or find where a security review should focus. Also invoke when asked to triage or prioritize security effort across a repository.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/hotspots" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/hotspots ~/.claude/skills/hotspotsFrom README
Security Hotspot Analysis (A06:2025) What this checks Maps security-sensitive code so reviewers know where to focus. Missed hotspots mean entire attack surfaces go unreviewed. Single source of truth: this skill delegates to the hotspot-mapping subagent in .claude/agents/hotspot-mapping.md. The subagent's JSON output is the canonical hotspot shape; this skill adds an architecture summary and renders the result as a priority table. Vulnerable patterns This skill does not target a single antipattern — the hotspot-mapping subagent identifies areas where vulnerabilities are statistically most likely (trust boundaries, auth/sessions, access control, data layer, crypto/secrets, external calls). See the agent's category taxonomy for the full list. Procedure Step 1 — Architecture summary. Read README, ARCHITECTURE, docs/, SECURITY, and CONTRIBUTING. Produce a 3-6 bullet summary: what the system does, major components, trust boundaries, auth model, data stores, external integrations.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...