vbsec: security scan for AI-written code
vbsec
A skill for Claude Code and Codex that finds common vulnerabilities in AI-written code and shows a fix for each
- 314 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The skill reads the whole repository and writes reports that quote vulnerable spots and attack paths
- With a separate flag the skill rewrites source files or goes to OSV.dev over the network
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/vbsecDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The skill reads the whole repository and writes reports that quote vulnerable spots and attack paths
- With a separate flag the skill rewrites source files or goes to OSV.dev over the network
This is third-party code. Review the repository files before installing.
What it does
vbsec scans AI-written code and produces a report covering 21 vulnerability types, from SQL injection and XSS to races when deducting a balance. The skill traces where data came from and splits sources into four trust levels: from "sent by a stranger", like forms and headers, to "produced by the system", like constants. Only what travels from a stranger to a dangerous call without cleaning reaches the report. For each finding the report gives why it is dangerous, a step-by-step attack scenario, the current code and the fixed one. Go, PHP, Python, .NET, TypeScript and JavaScript have dedicated rules that account for popular frameworks such as Django and Laravel. You can scan the whole repository, one commit or a pull request, or changes from the last N days.
Who it is for. For developers who ship AI-written code and want to check it before a commit without deep security expertise.
Good fit when
- Before each commit you need to check uncommitted changes
- The agent wrote JWT authorization or a search with a database query and you want to be sure it has no obvious hole
- You need a report file for whoever will fix the issues: it is saved in `vbsec-reports/` and ends with a JSON block for CI/CD
- Someone else pull request is being reviewed: the `pr id <number>` scope takes the diff from GitHub through `gh`
- The code sits in a plain folder without git, for example generation output: the skill scans that too
Not a fit when
- You need a formal audit or penetration test: the skill finds common mistakes and does not replace a specialist review
- The main language of the project is outside Go, PHP, TypeScript, Python and .NET: deep rules exist only for them
- You need a deterministic result: AI output can differ from run to run
- You need a static analyzer with CI guarantees: separate scanners with fixed rules fit better
Example request
/vbs-scan-security uncommitted lang=en — check my uncommitted changes and show how to fix each finding.Limitations
The result depends on the model and may change between runs. On eight sample apps with planted bugs the author caught 54 of 55 with no false alarms, and the numbers on your code will differ. The report is in Vietnamese by default. The `pr id` scope needs the GitHub CLI. The optional `--sca` flag goes to the network for OSV.dev data, and the `--auto-fix` flag edits source files and requires a git repository. In Codex and Antigravity the scan runs sequentially and is noticeably slower on large repositories than in Claude Code with parallel subagents.
How to disable. Remove the `~/.claude/skills/vbs-scan-security` symlink and, if you wish, the `~/vbsec` folder, then restart the agent. Generated reports sit in `vbsec-reports/` inside scanned projects: add that path to `.gitignore` or delete the folder.
FAQ
How do I install vbsec in Claude Code?
Run `git clone https://github.com/tanviet12/vbsec ~/vbsec` and `~/vbsec/scripts/install.sh`. The script installs the skill for every agent it finds. To update, go to `~/vbsec` and run `git pull`.
Which vulnerabilities does vbsec look for?
21 common types, from secrets in code and SQL injection to races and vulnerable dependencies. The full list with examples is in the rules reference in the docs folder.
How do I scan only my changes?
`/vbs-scan-security uncommitted` scans what is uncommitted, the staged scope takes indexed files and `commit id <sha>` takes a specific commit. In Codex the call looks like `$vbs-scan-security`.
Why are there fewer false alarms than with pattern scanners?
The skill reads the surrounding code and works out where a value came from. A query with a constant passes without a flag, and one with input from a search box goes into the report.
What language is the report in?
Vietnamese by default. Add `lang=en` or `--en` for English. The JSON block at the end of the report is always English, and CI/CD reads it.
Discussion
No questions or reviews yet.
Related
SkillsVibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
Security audit skill with GOST and FSTEC
Security Audit Skill for Claude Code
A security audit skill for Claude Code: OWASP Top 10 plus GOST R 56939, FSTEC Order No. 21 and 152-FZ, parallel subagents and a compliance matrix
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
A skill that audits vibe-coded apps: secrets, Supabase RLS, authorization, payments, rate limits, mobile and AI integrations
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| vbsec: security scan for AI-written code (this entry) | no | 314 | |
| VibeSec | no | 1,379 | a secure-development skill that prevents common vulnerabilities while code is written |
| security-audit | no | 52,818 | a Cloudflare security audit with recon, coverage hunting and independent verification |
README in short
The repository has three skill sets with the same rules: for Claude Code, Codex and Antigravity. The docs folder holds installation, a rules reference and sample reports, and scripts holds the fixture run and a check of its results.
README badge
Original SKILL.md
--- name: vbs-scan-security description: Use when scanning code for security vulnerabilities. Use when user says "scan security", "kiểm tra bảo mật", "security audit", "review security", or invokes `/vbs-scan-security`. Auto-delegates to sub-agents for large scans (>20 main-language files OR >30 total OR >14 days). Outputs bilingual reports (vi/en). Optional `--auto-fix` (agentic patch + verify loop) and `--sca` (live CVE lookup via OSV.dev). userInvocable: true --- # vbsec — Security Scanner cho Vibe Coders Quét lỗ hổng bảo mật cho code do AI sinh ra (vibe code). Bộ skill này check 21 lỗi bảo mật phổ biến nhất của vibe code, kế thừa kiến trúc SMALL/LARGE mode từ bộ rule production của SePay, tổng quát hóa cross-language (mặc định) + chuyên sâu cho Go/PHP (phase 1). > Public repo: https://github.com/tanviet12/vbsec > License: MIT (sẽ chốt khi public) ## Invocation | Command | Scope | Mô tả | |---|---|---| | `/vbs-scan-security` | **Toàn repo** (default từ v0.3) | Mặc định — quét toàn bộ repo | | `/vbs-scan-security all` | Toàn repo | Alias explicit của default | | `/vbs-scan-security uncommitted` | Uncommitted changes | Quét staged + unstaged (cần explicit từ v0.3) | | `/vbs-scan-security diff` | Uncommitted changes | Alias intuitive cho `uncommitted` | | `/vbs-scan-security staged` | Staged files only | Pre-commit scan | | `/vbs-scan-security commit within Xdays` | Recent commits | Quét commit X ngày gần đây | | `/vbs-scan-security commit id <sha>` | Specific commit | Quét 1 commit | | `/vbs-scan-security pr id <number>` | Pull request | Quét PR diff (cần `gh` CLI) | **v0.3 change:** Default scope đổi từ `uncommitted` → `all`. Non-tech user lần đầu chạy không bị confused bởi report rỗng. Để giữ behavior cũ, dùng `uncommitted` hoặc `diff` explicit. **Lựa chọn ngôn ngữ output (thêm vào bất kỳ scope nào):** - `lang=vi` hoặc `--vi` → Tiếng Việt (mặc định) - `lang=en` hoặc `--en` → English **Cờ tùy chọn (v0.7+, mặc định TẮT — thêm vào bất kỳ scope nào):** | Flag | Alias | Mô tả | |---|---|---| | `--sca` | `sca` | Tra cứu CVE **live** qua OSV.dev cho dependency (5 ecosystem: NuGet/Go/npm/Composer/PyPI). Xem [`references/dependency-scan.md`](references/dependency-scan.md). Cần network. | | `--auto-fix` | `auto-fix` | Tự sinh patch (unified diff) cho finding CRITICAL/HIGH, verify bằng build command, revert nếu fail. Xem [`workflows/auto-fix.md`](workflows/auto-fix.md). **Ghi đè file nguồn** — cần git repo, khuyến nghị working tree sạch trước khi chạy. | | `--run-tests` | — | Chỉ có tác dụng cùng `--auto-fix`: cho phép chạy test của project (`go test ./...`, `dotnet test`) để verify bản nâng version dependency. **Test có thể đụng hệ thống thật** (DB, dịch vụ trong `.env`) — chỉ bật khi test an toàn. Không bật → bump dependency chỉ là gợi ý patch. | Ví dụ: ``` /vbs-scan-security pr id 42 lang=en /vbs-scan-security staged --vi /vbs-scan-security commit within 7days