# overreliance

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects systems that treat LLM output as authoritative fact in consequential decisions without human review. Use when writing code that displays LLM output as authoritative fact, uses LLM decisions to gate consequential outcomes without human review, or builds automated pipelines where LLM judgment drives downstream actions.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/overreliance ~/.claude/skills/overreliance
```

## From README

Overreliance on LLM Output (OWASP LLM09:2025) What this checks Prevents systems from treating LLM output as ground truth. LLMs hallucinate, produce confident-sounding errors, and lack real-time knowledge. Acting on unverified output in medical, legal, financial, or deployment contexts can cause serious harm. Vulnerable patterns LLM diagnosis, legal advice, or financial guidance displayed in the UI with no caveat or disclaimer. Automated pipeline that merges, deploys, or publishes based solely on an LLM approval signal. Confidence threshold defined as a constant but never used to branch behavior — every non-null response is accepted. High-stakes domain list defined but never compared against the current request before action. No alternate path when the LLM output fails a sanity check or confidence threshold. Fix immediately Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/overreliance/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars