From soundcheck
Maps security hotspots in codebases by scanning for auth, access control, data queries, crypto ops, external calls, and trust boundaries to prioritize reviews.
npx claudepluginhub thejefflarson/soundcheck --plugin soundcheckThis skill uses the workspace's default tool permissions.
Maps security-sensitive code so reviewers know where to focus. Missed hotspots mean
Audits code security using STRIDE threat modeling, attack trees, CVSS severity ranking, OWASP patterns, and CWE analysis for vulnerabilities in auth, inputs, crypto, and dependencies.
Scans codebases for OWASP Top 10 vulnerabilities via static analysis: secret exposure, injection flaws, auth/authz gaps, supply-chain risks, misconfigurations, logging failures. Use before deployments, PR merges, auth/payment changes.
Performs exploitability review of targeted code, tracing untrusted inputs through validation/processing/output, checking authorization completeness like IDOR, using shieldkit_scan baseline.
Share bugs, ideas, or general feedback.
Maps security-sensitive code so reviewers know where to focus. Missed hotspots mean entire attack surfaces go unreviewed.
This skill does not target a single antipattern — it identifies areas where vulnerabilities are statistically most likely:
Step 1 — Architecture summary. Read README*, ARCHITECTURE*, docs/,
SECURITY*, and CONTRIBUTING*. Produce a 3–6 bullet summary: what the system
does, major components, trust boundaries, auth model, data stores, external
integrations. Without this framing you cannot tell a critical boundary from a
helper.
Step 2 — Hotspot scan. Skip node_modules/, .venv/, dist/, build/,
target/.
For each file, look for:
TRUST BOUNDARIES — route handlers, CLI arg parsing, file upload
endpoints, WebSocket/SSE handlers, IPC listeners
AUTH & SESSIONS — login/logout, signup, password reset, JWT
creation/validation, OAuth callbacks, API key checks
ACCESS CONTROL — role/permission checks, object-level lookups by ID
DATA LAYER — SQL/ORM queries, deserialization (pickle, YAML, marshal),
file read/write with dynamic paths
CRYPTO & SECRETS — encrypt/decrypt, hashing, key generation, TLS
config, secret loading from env/vault/config
EXTERNAL CALLS — HTTP clients, LLM API calls, email/SMS/payment,
cloud SDK usage
Output format:
| Priority | Category | File | Lines | What |
|---|
Priority: Critical (auth, crypto, direct user input), High (access control, data persistence), Medium (logging, external calls, config).
After producing the table, recommend which Soundcheck skills to run against each hotspot category.