pr-review
Lightweight per-PR security gate that detects Critical and High severity OWASP/LLM issues in changed files only. Use when scanning a small git diff in CI for blocking findings. Single-pass; does not dispatch subagents and does not perform threat modeling or attack-chain analysis.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/pr-review" into this agent's normal skills directory: use the OMGSkills MCP get_skill tool, install only the pinned_install commit and path, verify SKILL.md against pinned_install.skill_md_sha, and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/pr-review ~/.claude/skills/pr-reviewFrom README
Pull Request Security Gate (A01:2025–A10:2025 + LLM01:2025–LLM10:2025) What this checks Fast single-pass review of the files in a pull request diff. Reports only Critical and High severity findings. Designed for CI: completes in seconds-to-minutes on haiku, well under the time a developer expects to wait on a PR check. This is the per-PR gate. For nightly or deep audits, reach for security-review or contract-review. Vulnerable patterns Soundcheck's per-category skills (injection, csrf, ssrf, broken-access-control, authentication-failures, hardcoded-secrets, path-traversal, prompt-injection, …) auto-invoke when their description matches code in the diff.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...