From soundcheck
Detects insecure defaults, overly permissive CORS, exposed debug endpoints, and missing security headers in server configuration and middleware.
How this skill is triggered — by the user, by Claude, or both
Slash command
/soundcheck:security-misconfigurationThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Protects against insecure defaults, overly permissive policies, and missing hardening
Protects against insecure defaults, overly permissive policies, and missing hardening that expose the application to cross-origin attacks, credential stuffing, and information disclosure via error pages or debug endpoints.
Strict-Transport-Security, X-Content-Type-Options, and a framing/CSP control missing. For hardcoded secrets see hardcoded-secrets.Flag the vulnerable code, explain the risk, and suggest a fix establishing these properties. Translate to the language and framework of the audited file — use that stack's documented middleware or configuration helpers; do not import recipes from a different stack.
Origin header. Browsers block wildcard-plus-credentials in spec, but misconfigured middleware still ships it.Strict-Transport-Security, X-Content-Type-Options: nosniff, and a framing or CSP control. An upstream proxy may own these instead — but only if that ownership is documented at the call site.Confirm the following properties hold (language-agnostic):
*) or a reflected Origin headerStrict-Transport-Security, X-Content-Type-Options, and a framing/CSP control — unless the code comments explicitly document that an upstream proxy owns these headersnpx claudepluginhub thejefflarson/soundcheck --plugin soundcheckDetects security misconfigurations like enabled debug modes, default credentials, missing security headers, exposed endpoints, and TLS issues using grep patterns in Python/Django/Flask, Java/Spring, PHP/Laravel, Go/Gin, Node.js apps.
Audits HTTP security headers (CSP, HSTS, X-Frame-Options, Permissions-Policy), identifies overly permissive directives, and generates production-ready policies for web applications.
Validates HTTP security headers in web app responses, identifies issues like missing CSP or HSTS, rates posture, checks OWASP compliance, and suggests fixes for XSS, clickjacking, and MIME sniffing.