From soundcheck
Flags authentication security failures like weak JWT secrets, signature bypass, persistent sessions after logout, missing constant-time comparisons, and login rate limits. Suggests fixes.
npx claudepluginhub thejefflarson/soundcheck --plugin soundcheckThis skill uses the workspace's default tool permissions.
Protects identity and session integrity. Weak password storage, flawed JWT handling,
Audits authentication in web apps/APIs: password hashing, JWT handling, sessions, OAuth flows, MFA, and account controls against OWASP/NIST standards.
Analyzes auth mechanisms (passwords/sessions/JWT/OAuth/MFA) and authz patterns (RBAC/ABAC/ACL) for vulnerabilities like bypasses, hijacking, broken access control; reports with OWASP/NIST remediation.
Audits and hardens authentication code against security best practices. Covers credential storage, error handling, sessions, input validation, OAuth/OIDC, MFA/passkeys, rate limiting, CSRF, and HTTP headers.
Share bugs, ideas, or general feedback.
Protects identity and session integrity. Weak password storage, flawed JWT handling, and sessions that survive logout let attackers impersonate users, escalate privileges, and persist after credential rotation.
jwt.decode(token, "secret", algorithms=["HS256"]) — weak or hardcoded JWT secretjwt.decode(token, options={"verify_signature": False}) — signature bypassdb.delete_session missing on logout — session persists after sign-outFor password hashing issues (MD5/SHA), see cryptographic-failures.
For hardcoded API keys/passwords in source, see hardcoded-secrets.
Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
none and rejects algorithm switching between symmetric and
asymmetric families (the classic HS256-vs-RS256 public-key-as-HMAC attack).
Whether expressed as algorithms=[...], .withAlgorithm(...),
Validation::new(Algorithm::HS256), or equivalent, the check must be
algorithm-specific.hmac.compare_digest or the language equivalent, never ==.Anchor — shape, not implementation:
secret = getenv("JWT_SECRET"); require(len(secret) >= 32) # loaded + checked
token = encode(claims, secret, alg=HS256) # exp set
decoded = decode(token, secret, algorithms=[HS256]) # alg pinned
logout(token): revocation.add(token) # server-side invalidation
verify(t): return t not in revocation and decode(t) # revocation checked
Confirm these properties hold (language-agnostic):
none and rejects algorithm switching between symmetric and asymmetric families — whether expressed as a algorithms=[...] parameter, a .withAlgorithm(...) builder call, a Validation::new(Algorithm::HS256) constructor, or equivalent