ipc-security
Detects IPC receivers that accept input without verifying caller identity. Use when writing URL scheme handlers, Android intent receivers or exported activities, named pipe or socket listeners, XPC service handlers, or any IPC endpoint that processes caller-supplied input without validating the caller's identity or origin.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/ipc-security" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/ipc-security ~/.claude/skills/ipc-securityFrom README
IPC Security (A01:2025) What this checks Detects IPC receivers that accept input without verifying the caller's identity. Open IPC channels let malicious apps hijack URL schemes, trigger exported components, or inject data through shared channels.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...