From soundcheck
Flags HTTP header injection (CWE-113) vulnerabilities when setting response headers from user input, parameters, or external data. Recommends CRLF stripping for headers, Content-Disposition filenames, Location headers, and forwarded values.
npx claudepluginhub thejefflarson/soundcheck --plugin soundcheckThis skill uses the workspace's default tool permissions.
Protects against HTTP response header injection where user input containing `\r\n`
Configures HTTP security headers like HSTS, CSP, X-Frame-Options, X-Content-Type-Options for Express, Nginx, Flask. Protects against XSS, clickjacking, MIME sniffing; useful for hardening web apps and passing audits.
Audits HTTP security headers like CSP, HSTS, X-Frame-Options; identifies permissive directives; generates secure policies for web apps on Next.js, Express, Nginx, Vercel.
Generates security headers configurations and provides step-by-step guidance for security fundamentals including authentication, input validation, secure coding, and vulnerability detection. Useful for web security tasks.
Share bugs, ideas, or general feedback.
Protects against HTTP response header injection where user input containing \r\n
(CRLF) characters is included in response headers, allowing attackers to inject
arbitrary headers or split the HTTP response. Exploitation leads to cache poisoning,
session fixation, XSS via injected headers, and response splitting.
response.headers["X-Custom"] = user_input — CRLF in input injects new headersw.Header().Set("Content-Disposition", "attachment; filename=" + filename) — newlines in filenamectx.set("Location", redirectUrl) — CRLF splits responseresp.setHeader("X-Request-Id", req.getHeader("X-Correlation-Id")) — forwarding unsanitized headerFlag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
\r\n in a value ends the header block
and starts a new header (or a new response body). The strip happens at or
before the call site — relying on the framework to reject it is fragile
across versions.filename*=UTF-8''…
rather than raw UTF-8 in the header value.open-redirect skill for target-host validation.Anchor — shape, not implementation:
def safe_header(v): return v.replace("\r", "").replace("\n", "")
response.set_header("X-Custom", safe_header(user_input))
response.set_header("Location", safe_header(validated_url))
response.set_header("Content-Disposition", f'attachment; filename="{safe_header(name)}"')
\r and \n characters stripped or rejected before being set