# security-review

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Runs a full OWASP/CWE security audit via isolated subagents. Use when the user types /security-review or explicitly requests a full security audit of the current code.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/security-review ~/.claude/skills/security-review
```

## From README

Full Security Audit (A01:2025–A10:2025 + LLM01:2025–LLM10:2025) What this checks Full repo audit against OWASP Web + LLM Top 10:2025 via a four-stage pipeline: threat-model → hotspots → review → validate. Main context dispatches subagents (threat-modeling, hotspot-mapping, vulnerability-audit, design-review, finding-validate, attack-chain-analysis) and renders findings; never reads code. Vulnerable patterns This skill is the orchestrator. The actual pattern catalog lives in the per-category auto-invoking skills (injection, csrf, ssrf, broken-access-control, authentication-failures, etc.) — the vulnerability-audit subagent picks the right one per hotspot and applies its Vulnerable patterns section. Skill-list maintenance is automatic via .claude/skills/ directory contents; no separate catalog file. Procedure Use only the Agent tool in main context. No Read/Grep/Glob/ Bash in main context.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/security-review/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars