# redos

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects regex patterns vulnerable to catastrophic backtracking on crafted inputs. Use when writing regular expressions that will be applied to user- supplied input. Also invoke when compiling regexes from external configuration, building input validation patterns, or parsing untrusted strings with regex.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/redos ~/.claude/skills/redos
```

## From README

ReDoS Security Check (CWE-1333) What this checks Protects against Regular Expression Denial of Service where a crafted input causes catastrophic backtracking in regex engines. A single malicious string can pin a CPU core for minutes or hours, taking down the service. Vulnerable patterns Nested quantifiers applied to user input — a quantified group whose body is itself quantified produces exponential state Overlapping alternation inside repetition — alternatives that can match the same prefix multiply backtracking work Common "email" or "URL" regexes built from quantified character classes wrapped in further repetition Regexes compiled from external configuration or user input where the pattern shape itself is attacker-controlled Fix immediately Flag the vulnerable regex, explain the risk, and suggest a fix establishing these properties. Translate the principle to the language and engine of the audited file — do not echo examples from another stack. No nested quantifiers on user input.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/redos/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars