security-review
Runs a full OWASP/CWE security audit via isolated subagents. Use when the user types /security-review or explicitly requests a full security audit of the current code.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/security-review" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/security-review ~/.claude/skills/security-reviewFrom README
Full Security Audit (A01:2025–A10:2025 + LLM01:2025–LLM10:2025) What this checks Full repo audit against OWASP Web + LLM Top 10:2025 via a four-stage pipeline: threat-model → hotspots → review → validate. Main context dispatches subagents (threat-modeling, hotspot-mapping, vulnerability-audit, design-review, finding-validate, attack-chain-analysis) and renders findings; never reads code. Vulnerable patterns This skill is the orchestrator. The actual pattern catalog lives in the per-category auto-invoking skills (injection, csrf, ssrf, broken-access-control, authentication-failures, etc.) — the vulnerability-audit subagent picks the right one per hotspot and applies its Vulnerable patterns section. Skill-list maintenance is automatic via .claude/skills/ directory contents; no separate catalog file. Procedure Use only the Agent tool in main context. No Read/Grep/Glob/ Bash in main context.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...