privilege-handling
Detects unsafe privilege handling in SUID/SGID binaries, environment-variable trust in privileged code, insecure umask, temp-file races, and symlink-follow bugs in /tmp. Use when writing or modifying SUID/SGID-installed code, code that drops or elevates privileges via setuid/setgid/seteuid/seteuid_r, anything that reads PATH/LD_*/IFS environment variables, code that creates files in /tmp or other world-writable directories, or anything that opens a file whose path may contain a symlink controlled by a less-privileged user.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/privilege-handling" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/privilege-handling ~/.claude/skills/privilege-handlingFrom README
Privilege Handling (CWE-271, CWE-426, CWE-377, CWE-61) What this checks Privileged programs (SUID/SGID, root daemons, container init) operate with a credentials gap. Classic mistakes: privileges dropped in the wrong order, environment variables trusted from an attacker-controlled shell, temp files where an attacker can symlink-swap before write. Local pattern, cross-trust-boundary consequence. LSMs provide defense in depth; this catches the source-level mistake. Vulnerable patterns Privileged process drops the effective UID only, leaving the saved set-user-ID intact so the process can regain root later. Privileged exec resolves the program name via PATH, letting the attacker plant a lookalike earlier in the search path. Privileged code inherits LDPRELOAD, LDLIBRARYPATH, or IFS from the calling environment without scrubbing them. Process runs with no umask call (or an explicit zero umask), leaving created files world-writable.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...