Detects and remediates PHP type juggling vulnerabilities and loose comparison security flaws in codebases.
This skill empowers Claude to perform deep security audits on PHP code, specifically identifying 'type juggling' vulnerabilities where loose comparisons lead to authentication bypasses or logic errors. It scans for common pitfalls like non-strict in_array calls, unsafe switch statements, and cryptographic hash comparison flaws—such as 'magic hashes'—while providing automated fixes using strict comparisons, match expressions, and timing-safe functions like hash_equals.
Key Features
01Validates types in json_decode outputs to prevent integer-to-string coercion
02Detects 'magic hash' vulnerabilities in MD5 and SHA1 comparisons
03Suggests upgrading vulnerable switch statements to strict match expressions
04Identifies unsafe loose comparisons (==) with user-controlled input
05Flags in_array and array_search calls missing the strict boolean flag
0645 GitHub stars
Use Cases
01Hardening authentication and authorization logic against bypass exploits
02Performing automated security code reviews for OWASP compliance
03Refactoring legacy PHP codebases to modern, type-safe standards
