# hotspots

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Maps security-sensitive code locations in a codebase to focus review effort. Use when the user asks to identify security-sensitive areas in a codebase, map the attack surface, or find where a security review should focus. Also invoke when asked to triage or prioritize security effort across a repository.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/hotspots ~/.claude/skills/hotspots
```

## From README

Security Hotspot Analysis (A06:2025) What this checks Maps security-sensitive code so reviewers know where to focus. Missed hotspots mean entire attack surfaces go unreviewed. Single source of truth: this skill delegates to the hotspot-mapping subagent in .claude/agents/hotspot-mapping.md. The subagent's JSON output is the canonical hotspot shape; this skill adds an architecture summary and renders the result as a priority table. Vulnerable patterns This skill does not target a single antipattern — the hotspot-mapping subagent identifies areas where vulnerabilities are statistically most likely (trust boundaries, auth/sessions, access control, data layer, crypto/secrets, external calls). See the agent's category taxonomy for the full list. Procedure Step 1 — Architecture summary. Read README, ARCHITECTURE, docs/, SECURITY, and CONTRIBUTING. Produce a 3-6 bullet summary: what the system does, major components, trust boundaries, auth model, data stores, external integrations.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/hotspots/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars