# numeric-trust-boundary

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects untrusted numeric input that flows through a conversion, cast, or parser into a length, size, index, or authorization comparison without bounds-checking the post-conversion value. Use when writing or modifying code that calls atoi/strtol/parseInt/strconv.Atoi on user-supplied or network-supplied input, casts between signed and unsigned integer types, narrows an integer width before a bounds check, or uses an untrusted integer as an allocation size, array index, file offset, length argument to memcpy, or comparison gate for authorization or permission decisions.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/numeric-trust-boundary ~/.claude/skills/numeric-trust-boundary
```

## From README

Numeric Trust Boundary (CWE-190, CWE-194, CWE-704, CWE-20) What this checks Plain numeric-conversion bugs (parser returns zero on garbage, divide-by-zero, float equality) are correctness issues that standard linters catch. This skill targets the security subset: an untrusted integer (from a string parser, a wire-protocol length field, a JSON number) that flows into a length, size, index, or permission sink without a bounds check on the post-conversion value. Local pattern only — conversion within a function or two of the sink. Vulnerable patterns Sign-extension when a narrow signed value is cast into a width-or-size type — a byte of 0xFF becomes a huge unsigned length. A string-to-integer parser whose error indicator is the same value as legitimate zero, used as an authorization or identity key without checking the parse-failure flag. Width truncation inside a bounds check — the narrowed value passes the check, but the full-width value is used at the sink.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/numeric-trust-boundary/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars