From soundcheck
Detects open redirect vulnerabilities (CWE-601) when redirecting to user-supplied URLs from params, forms, login flows, or OAuth callbacks. Suggests host allowlist validation fixes.
npx claudepluginhub thejefflarson/soundcheck --plugin soundcheckThis skill uses the workspace's default tool permissions.
Protects against open redirect vulnerabilities where an attacker crafts a link that
Tests open redirect vulnerabilities in web apps by identifying redirect parameters, applying bypass payloads, and chaining for phishing or token theft in login/OAuth/SSO flows.
Identifies and tests open redirect vulnerabilities in web apps by analyzing URL parameters, bypass techniques like encoding and subdomain tricks, and phishing exploitation chains. Useful for login, OAuth, and SSO audits.
Tests web apps for open redirect vulnerabilities via URL parameter analysis, bypass payloads like encoding/@ tricks, and chains for phishing/OAuth token theft.
Share bugs, ideas, or general feedback.
Protects against open redirect vulnerabilities where an attacker crafts a link that redirects users from a trusted domain to a malicious site. Used in phishing campaigns to make malicious links appear legitimate, and in OAuth flows to steal authorization codes.
redirect(request.args["next"]) — redirects to any URL the caller supplieshttp.Redirect(w, r, r.URL.Query().Get("return"), 302) — no validationresponse.sendRedirect(req.getParameter("url")) — Java unvalidated redirectwindow.location = params.get("redirect") — client-side open redirectFlag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
startswith) is not sufficient —
allowed.com.evil.com passes a prefix check.//
parses as a protocol-relative URL and redirects to whatever host follows.
Checking for http:// / https:// alone misses this./, home, dashboard)
rather than echoing an error containing the malicious URL. Echoing it back
gives attackers a reflected-XSS surface.Anchor — shape, not implementation:
def safe_redirect(target):
if target.startswith("//"): return "/" # block scheme-relative
u = parse(target)
if u.host and u.host not in ALLOWED_HOSTS: return "/"
return target
//evil.com) are blocked — not just http:// and https://