concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock, lock-free atomics use the wrong memory ordering, or double-checked locking is missing the necessary barrier. Use when writing or modifying code that acquires multiple locks, uses atomic operations with explicit memory orders (std::memory_order_*, atomic.LoadAcquire, Ordering::Relaxed), implements lazy initialization with double-checked locking, or calls a blocking operation (I/O, sleep, await, blocking channel send) inside a locked region.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/concurrency-correctness" into this agent's normal skills directory: use the OMGSkills MCP get_skill tool, install only the pinned_install commit and path, verify SKILL.md against pinned_install.skill_md_sha, and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/concurrency-correctness ~/.claude/skills/concurrency-correctnessFrom README
Concurrency Correctness (CWE-833, CWE-820, CWE-667) What this checks Concurrency bugs that read clean in isolation but produce deadlocks, lost wakeups, or data races in production. Race detectors catch triggered races but not structural mistakes. Flags local patterns: lock-around-blocking-call, lock-order in nested acquires, atomic memory order, double-checked locking. Not a replacement for whole-program ownership analysis (borrow checker, lockdep, model checking).
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
contract-review
Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce.