seccheck

A Claude Code skill that runs a deep security audit on code changes or a codebase. Thinks like an attacker, reports like an engineer. Built for production AI products — gives extra weight to prompt injection, agent authorization, and LLM cost-blowup vectors that generic OWASP guides skip.

What it covers

10 domains:

1. Injection — SQL, command, path, template, and prompt injection for AI features
2. Auth & authorization — endpoint coverage, per-resource IDOR checks, JWT hygiene
3. Sensitive data exposure — PII / PHI / secrets in logs, over-fetching, error leakage
4. Cryptography — weak hashes, predictable random, TLS verification, encryption modes
5. Dependencies & supply chain (on --full) — CVEs, typosquats, unpinned versions
6. Rate limiting & abuse — public endpoints, LLM cost caps, auth lockouts, agent loops
7. Secrets management — least privilege, rotation, git history leaks
8. Trust boundaries — input validation at every system seam, webhook signatures
9. Error handling & info leakage — stack traces, 404-vs-403, debug mode in prod
10. Compliance (on --hipaa or --soc2) — PHI handling, audit trails, least-privilege

Install

git clone https://github.com/matthewkim323/seccheck ~/.claude/skills/seccheck

Use

seccheck                     # audit git diff HEAD
seccheck path/to/file.py     # audit a specific file/dir
seccheck --triage            # fast mode: only SEC-1/2/3 (injection, auth, data exposure)
seccheck --hipaa             # adds PHI-handling checks
seccheck --soc2              # adds audit-trail + availability checks
seccheck --full              # adds dependency CVE scan

Or just say "is this secure" / "check for prompt injection" / "security audit".

Output

Every finding is severity-tagged (🔴 Critical / 🟡 High / 🟠 Medium / ℹ️ Info), includes the file:line, an attack scenario in plain English, and a concrete before/after fix. The report leads with an "attack surface" map so the audit is grounded in the actual blast radius, not a generic checklist.

Pairs with /prodcheck

Run /prodcheck first for general production readiness. Run /seccheck for adversarial review. They overlap intentionally on secret hygiene and input validation (overlap is good — two angles on the most critical stuff) but cover otherwise different ground.

License

MIT.