pr-review
Lightweight per-PR security gate that detects Critical and High severity OWASP/LLM issues in changed files only. Use when scanning a small git diff in CI for blocking findings. Single-pass; does not dispatch subagents and does not perform threat modeling or attack-chain analysis.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/pr-review" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/pr-review ~/.claude/skills/pr-reviewFrom README
Pull Request Security Gate (A01:2025–A10:2025 + LLM01:2025–LLM10:2025) What this checks Fast single-pass review of the files in a pull request diff. Reports only Critical and High severity findings. Designed for CI: completes in seconds-to-minutes on haiku, well under the time a developer expects to wait on a PR check. This is the per-PR gate. For nightly or deep audits, reach for security-review or contract-review. Vulnerable patterns Soundcheck's per-category skills (injection, csrf, ssrf, broken-access-control, authentication-failures, hardcoded-secrets, path-traversal, prompt-injection, …) auto-invoke when their description matches code in the diff.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...