Claude Skills by thejefflarson

Detects weak password storage, flawed JWT validation, sessions surviving

Detects missing ownership checks, broken role enforcement, and IDOR

Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock, lock-free atomics use the wrong memory ordering, or double-checked locking is missing the necessary barrier. Use when writing or modifying code that acquires multiple locks, uses atomic operations with explicit memory orders (std::memory_order_*, atomic.LoadAcquire, Ordering::Relaxed), implements lazy initialization with double-checked locking, or calls a blocking operation (I/...

Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce. Designed for nightly CI, pre-release scans, or manual deep audits — runs in tens of minutes, not seconds. Surfaces bugs that single-pass OWASP review misses — caller/callee invariant gaps, trust-anchor confusion, predicate misnaming.

Detects library-internal cryptographic correctness bugs that pattern matchers and crypto-failures skills miss — AEAD nonce reuse, ECDSA k-value reuse, length-extension on bare hashes, padding-oracle exception distinguishability, and branching on secret material. Use when writing code that calls a crypto primitive directly (AEAD encrypt/decrypt, ECDSA/DSA sign, raw hash, RSA decrypt). Distinct from cryptographic-failures, which covers application-layer choices like MD5 for passwords; this skil...

Detects weak or broken cryptography that lets attackers recover plaintext

Detects forms and state-changing endpoints missing CSRF protection. Use when

Detects error handlers that leak stack traces or fail open on exception. Use

Detects autonomous agents that take irreversible or high-impact actions

Detects file upload handlers that accept executable content or write to web-

Detects GraphQL schemas without depth limits, cost analysis, or introspection

Detects API keys, passwords, tokens, and credentials embedded directly in

Detects HTTP response header construction from user input vulnerable to CRLF

Maps security-sensitive code locations in a codebase to focus review effort.

Detects SQL, command, and template injection caused by user input reaching an

Detects missing security controls — rate limits, MFA, re-auth — that should

Detects sensitive data written to unprotected local files, preference stores,

Detects unsafe rendering or execution of LLM output that enables XSS, command

Detects LLM tool definitions without parameter validation, allowing prompt

Detects unsafe deserialization, unverified software updates, and tampered CI

Detects IPC receivers that accept input without verifying caller identity. Use

Detects compromised or backdoored models loaded from unverified sources,

Detects missing security event logs, logged secrets, and log injection through

Detects ORM create/update calls that spread request bodies without an explicit

Detects MCP tool handlers vulnerable to malicious inputs, hardcoded secrets,

Detects function-local misuse of memory and resource APIs in C, C++, and Rust unsafe — allocations whose return value is not checked, frees on error paths that race the success path, locks initialized incorrectly, file descriptors leaked across exec. Use when writing or modifying C or C++ code that calls malloc/calloc/realloc/free, mmap/munmap, pthread_mutex_*, fopen/open, or any kernel/library memory or resource primitive. Use when writing Rust code inside an unsafe block that calls a raw al...

Detects LLM endpoints missing token caps, rate limits, or prompt-length

Detects inference endpoints without authentication or throttling, allowing

Detects agent-to-agent calls without authentication, authorization, or

Detects MongoDB and other NoSQL queries that mix user input into operators or

Detects untrusted numeric input that flows through a conversion, cast, or parser into a length, size, index, or authorization comparison without bounds-checking the post-conversion value. Use when writing or modifying code that calls atoi/strtol/parseInt/strconv.Atoi on user-supplied or network-supplied input, casts between signed and unsigned integer types, narrows an integer width before a bounds check, or uses an untrusted integer as an allocation size, array index, file offset, length arg...

Detects weak JWT validation, loose redirect_uri matching, and missing state

Detects redirects to user-controlled URLs that enable phishing and OAuth

Detects systems that treat LLM output as authoritative fact in consequential

Detects file operations with user-controlled paths vulnerable to ../

Lightweight per-PR security gate that detects Critical and High severity OWASP/LLM issues in changed files only. Use when scanning a small git diff in CI for blocking findings. Single-pass; does not dispatch subagents and does not perform threat modeling or attack-chain analysis.

Detects unsafe privilege handling in SUID/SGID binaries, environment-variable trust in privileged code, insecure umask, temp-file races, and symlink-follow bugs in /tmp. Use when writing or modifying SUID/SGID-installed code, code that drops or elevates privileges via setuid/setgid/seteuid/seteuid_r, anything that reads PATH/LD_*/IFS environment variables, code that creates files in /tmp or other world-writable directories, or anything that opens a file whose path may contain a symlink contro...

Detects LLM prompts built from user input or retrieved documents that let

Detects JavaScript deep-merges or property assignment from user input that can

Detects check-then-act sequences on shared state vulnerable to TOCTOU

Detects RAG pipelines that ingest external documents into LLM context without

Detects regex patterns vulnerable to catastrophic backtracking on crafted

Applies fixes for security findings produced by /security-review. Use when the

Detects insecure defaults, overly permissive CORS, exposed debug endpoints,

Runs a full OWASP/CWE security audit via isolated subagents. Use when the user

Detects PII, credentials, and secrets passed to LLM APIs or embedded in system

Detects HTTP requests to user-controlled URLs that can reach internal services

Detects supply-chain risks in dependency manifests, lockfiles, install

Produces a threat model — purpose, deployment, trusted inputs, untrusted inputs — for a new feature or component before it's implemented. Use when writing an implementation plan for a new API endpoint, data pipeline, agent loop, or system component. Also invoke when a plan introduces new trust boundaries, handles user-supplied data, adds authentication flows, or integrates external services.

Detects user input passed to LLMs without Unicode normalization, allowing RTL