From soundcheck
Detects compromised or backdoored models from unverified sources, floating tags, or unreviewed registries. Use when downloading pre-trained models, loading from registries, integrating third-party LLM providers, or managing automated model updates.
How this skill is triggered — by the user, by Claude, or both
Slash command
/soundcheck:llm-supply-chainThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Protects against compromised or backdoored models introduced through unverified
Protects against compromised or backdoored models introduced through unverified
downloads, floating version tags, or unreviewed third-party providers. A tampered
model weight file or a silently swapped latest tag can introduce persistent
backdoors that survive retraining.
latest, main, a mutable branch) instead of an exact pinned revisionFlag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
main or latest. A floating tag lets the registry (or a
registry compromise) silently swap what you load on the next pull — including
backdoored weights that look identical by name.Translate these principles to the loader API, registry client, and CI system of the audited file. Use the SDK's documented pinning and verification mechanisms — do not implement ad-hoc checks.
Confirm the response:
"main" or "latest"npx claudepluginhub thejefflarson/soundcheck --plugin soundcheckScan models for malicious code in model registries. Use when building, configuring, or reviewing model registry security, model ingestion pipelines, or model validation workflows.
Detects AI/ML security vulnerabilities like unsafe model deserialization in PyTorch/Joblib/NumPy, prompt injection in LLM prompts, and risks in Jupyter notebooks or ML pipelines.
Assesses AI/LLM application security including prompt injection, jailbreak resistance, OWASP LLM Top 10 (2025), RAG/agent security, and model supply chain risks. Maps findings to MITRE ATLAS and recommends mitigations.