All authors
Claude Skills by thejefflarson
github.com/thejefflarson52 skills0 installs114 views
- Authentication FailuresDetects weak password storage, flawed JWT validation, sessions survivingVotes: 0GitHub stars: 20
- Broken Access ControlDetects missing ownership checks, broken role enforcement, and IDORVotes: 0GitHub stars: 20
- Concurrency CorrectnessDetects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock, lock-free atomics use the wrong memory ordering, or double-checked locking is missing the necessary barrier. Use when writing or modifying code that acquires multiple locks, uses atomic operations with explicit memory orders (std::memory_order_*, atomic.LoadAcquire, Ordering::Relaxed), implements lazy initialization with double-checked locking, or calls a blocking operation (I/...Votes: 0GitHub stars: 20
- Contract ReviewDeep review that audits API contracts for mismatches between what callers assume and what implementations enforce. Designed for nightly CI, pre-release scans, or manual deep audits — runs in tens of minutes, not seconds. Surfaces bugs that single-pass OWASP review misses — caller/callee invariant gaps, trust-anchor confusion, predicate misnaming.Votes: 0GitHub stars: 20
- Crypto Library MisuseDetects library-internal cryptographic correctness bugs that pattern matchers and crypto-failures skills miss — AEAD nonce reuse, ECDSA k-value reuse, length-extension on bare hashes, padding-oracle exception distinguishability, and branching on secret material. Use when writing code that calls a crypto primitive directly (AEAD encrypt/decrypt, ECDSA/DSA sign, raw hash, RSA decrypt). Distinct from cryptographic-failures, which covers application-layer choices like MD5 for passwords; this skil...Votes: 0GitHub stars: 20
- Cryptographic FailuresDetects weak or broken cryptography that lets attackers recover plaintextVotes: 0GitHub stars: 20
- CsrfDetects forms and state-changing endpoints missing CSRF protection. Use whenVotes: 0GitHub stars: 20
- Exceptional ConditionsDetects error handlers that leak stack traces or fail open on exception. UseVotes: 0GitHub stars: 20
- Excessive AgencyDetects autonomous agents that take irreversible or high-impact actionsVotes: 0GitHub stars: 20
- File UploadDetects file upload handlers that accept executable content or write to web-Votes: 0GitHub stars: 20
- Graphql SecurityDetects GraphQL schemas without depth limits, cost analysis, or introspectionVotes: 0GitHub stars: 20
- Hardcoded SecretsDetects API keys, passwords, tokens, and credentials embedded directly inVotes: 0GitHub stars: 20
- Header InjectionDetects HTTP response header construction from user input vulnerable to CRLFVotes: 0GitHub stars: 20
- HotspotsMaps security-sensitive code locations in a codebase to focus review effort.Votes: 0GitHub stars: 20
- InjectionDetects SQL, command, and template injection caused by user input reaching anVotes: 0GitHub stars: 20
- Insecure DesignDetects missing security controls — rate limits, MFA, re-auth — that shouldVotes: 0GitHub stars: 20
- Insecure Local StorageDetects sensitive data written to unprotected local files, preference stores,Votes: 0GitHub stars: 20
- Insecure Output HandlingDetects unsafe rendering or execution of LLM output that enables XSS, commandVotes: 0GitHub stars: 20
- Insecure Plugin DesignDetects LLM tool definitions without parameter validation, allowing promptVotes: 0GitHub stars: 20
- Integrity FailuresDetects unsafe deserialization, unverified software updates, and tampered CIVotes: 0GitHub stars: 20
- Ipc SecurityDetects IPC receivers that accept input without verifying caller identity. UseVotes: 0GitHub stars: 20
- Llm Supply ChainDetects compromised or backdoored models loaded from unverified sources,Votes: 0GitHub stars: 20
- Logging FailuresDetects missing security event logs, logged secrets, and log injection throughVotes: 0GitHub stars: 20
- Mass AssignmentDetects ORM create/update calls that spread request bodies without an explicitVotes: 0GitHub stars: 20
- Mcp SecurityDetects MCP tool handlers vulnerable to malicious inputs, hardcoded secrets,Votes: 0GitHub stars: 20
- Memory Api MisuseDetects function-local misuse of memory and resource APIs in C, C++, and Rust unsafe — allocations whose return value is not checked, frees on error paths that race the success path, locks initialized incorrectly, file descriptors leaked across exec. Use when writing or modifying C or C++ code that calls malloc/calloc/realloc/free, mmap/munmap, pthread_mutex_*, fopen/open, or any kernel/library memory or resource primitive. Use when writing Rust code inside an unsafe block that calls a raw al...Votes: 0GitHub stars: 20
- Model DosDetects LLM endpoints missing token caps, rate limits, or prompt-lengthVotes: 0GitHub stars: 20
- Model TheftDetects inference endpoints without authentication or throttling, allowingVotes: 0GitHub stars: 20
- Multi Agent TrustDetects agent-to-agent calls without authentication, authorization, orVotes: 0GitHub stars: 20
- Nosql InjectionDetects MongoDB and other NoSQL queries that mix user input into operators orVotes: 0GitHub stars: 20
- Numeric Trust BoundaryDetects untrusted numeric input that flows through a conversion, cast, or parser into a length, size, index, or authorization comparison without bounds-checking the post-conversion value. Use when writing or modifying code that calls atoi/strtol/parseInt/strconv.Atoi on user-supplied or network-supplied input, casts between signed and unsigned integer types, narrows an integer width before a bounds check, or uses an untrusted integer as an allocation size, array index, file offset, length arg...Votes: 0GitHub stars: 20
- Oauth ImplementationDetects weak JWT validation, loose redirect_uri matching, and missing stateVotes: 0GitHub stars: 20
- Open RedirectDetects redirects to user-controlled URLs that enable phishing and OAuthVotes: 0GitHub stars: 20
- OverrelianceDetects systems that treat LLM output as authoritative fact in consequentialVotes: 0GitHub stars: 20
- Path TraversalDetects file operations with user-controlled paths vulnerable to ../Votes: 0GitHub stars: 20
- Pr ReviewLightweight per-PR security gate that detects Critical and High severity OWASP/LLM issues in changed files only. Use when scanning a small git diff in CI for blocking findings. Single-pass; does not dispatch subagents and does not perform threat modeling or attack-chain analysis.Votes: 0GitHub stars: 20
- Privilege HandlingDetects unsafe privilege handling in SUID/SGID binaries, environment-variable trust in privileged code, insecure umask, temp-file races, and symlink-follow bugs in /tmp. Use when writing or modifying SUID/SGID-installed code, code that drops or elevates privileges via setuid/setgid/seteuid/seteuid_r, anything that reads PATH/LD_*/IFS environment variables, code that creates files in /tmp or other world-writable directories, or anything that opens a file whose path may contain a symlink contro...Votes: 0GitHub stars: 20
- Prompt InjectionDetects LLM prompts built from user input or retrieved documents that letVotes: 0GitHub stars: 20
- Prototype PollutionDetects JavaScript deep-merges or property assignment from user input that canVotes: 0GitHub stars: 20
- Race ConditionDetects check-then-act sequences on shared state vulnerable to TOCTOUVotes: 0GitHub stars: 20
- Rag SecurityDetects RAG pipelines that ingest external documents into LLM context withoutVotes: 0GitHub stars: 20
- RedosDetects regex patterns vulnerable to catastrophic backtracking on craftedVotes: 0GitHub stars: 20
- Security CleanupApplies fixes for security findings produced by /security-review. Use when theVotes: 0GitHub stars: 20
- Security MisconfigurationDetects insecure defaults, overly permissive CORS, exposed debug endpoints,Votes: 0GitHub stars: 20
- Security ReviewRuns a full OWASP/CWE security audit via isolated subagents. Use when the userVotes: 0GitHub stars: 20
- Sensitive DisclosureDetects PII, credentials, and secrets passed to LLM APIs or embedded in systemVotes: 0GitHub stars: 20
- SsrfDetects HTTP requests to user-controlled URLs that can reach internal servicesVotes: 0GitHub stars: 20
- Supply ChainDetects supply-chain risks in dependency manifests, lockfiles, installVotes: 0GitHub stars: 20
- Threat ModelProduces a threat model — purpose, deployment, trusted inputs, untrusted inputs — for a new feature or component before it's implemented. Use when writing an implementation plan for a new API endpoint, data pipeline, agent loop, or system component. Also invoke when a plan introduces new trust boundaries, handles user-supplied data, adds authentication flows, or integrates external services.Votes: 0GitHub stars: 20
- Token SmugglingDetects user input passed to LLMs without Unicode normalization, allowing RTLVotes: 0GitHub stars: 20