npx claudepluginhub thejefflarson/soundcheck --plugin soundcheckThis skill uses the workspace's default tool permissions.
Protects against information disclosure and fail-open logic. Stack traces in API responses leak internal paths, library versions, and logic for attackers to target; swallowed exceptions and default-allow error paths grant unintended access.
Detects exception handling vulnerabilities like XXE injection, stack trace disclosure, and improper error handling in Java and Python code for whitebox pentesting.
Provides OWASP Top 10 guidelines, secure Python/Flask coding patterns, prevention strategies, and remediation for access control and cryptographic vulnerabilities.
Implements standardized API error handling with RFC 7807 responses, typed error classes, middleware, and monitoring. Use for consistent HTTP errors across endpoints.
Share bugs, ideas, or general feedback.
Protects against information disclosure and fail-open logic. Stack traces in API responses leak internal paths, library versions, and logic for attackers to target; swallowed exceptions and default-allow error paths grant unintended access.
except Exception as e: return jsonify({"error": str(e)}), 500 — stack trace or internal message reaches clientexcept: pass — silent swallow; security-relevant failure goes undetectedexcept PermissionError: return allow() — fail-open grants access on errorapp.debug = True in production — full tracebacks exposed in HTTP responsesFlag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
except / catch / recover takes a
definite action: re-raise, log, or return a controlled error. A bare except: pass or catch (_) {} is the exact bug this skill prevents.PermissionError, AccessDenied,
or equivalent exception in a catch block must produce a deny response — never
a fall-through or default-allow. The safest pathway on ambiguity is refusal.app.debug=False, Spring server.error.include-stacktrace=never, Gin
ReleaseMode are set explicitly, not left at their development default.Anchor — shape, not implementation:
ref = new_uuid()
try: return handler(request)
except AuthzError: log(ref, exc); return error_response(403, ref)
except ValidationError: log(ref, exc); return error_response(400, ref)
except Exception: log(ref, full_traceback()); return error_response(500, ref)
# client sees: { "error": "...", "ref": ref } — no internal detail
Confirm the following properties hold (language-agnostic):
app.debug=False, Spring include-stacktrace=never, Go gin.ReleaseMode). Skip this criterion for library-level code or handlers that have no configuration surface