vibe-audit skill
Skill that scans a project for common vibe-coding holes: keys in code, .env in git, open LLM endpoints and weak auth.
- 107 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- The skill only reads the project, and the live site check makes ordinary GET requests against your own domain.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/vibe-auditDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The skill only reads the project, and the live site check makes ordinary GET requests against your own domain.
This is third-party code. Review the repository files before installing.
What it does
vibe-audit scans a project for common vulnerabilities AI assistants leave behind. The dependency-free Python script `audit.py` looks for hardcoded keys (OpenAI, Anthropic, AWS, GitHub, Stripe, Slack, Telegram, PEM), `.env` in git, secrets in variables with `NEXT_PUBLIC_`, `VITE_` and `REACT_APP_` prefixes, paid APIs called from the frontend, `CORS *`, `debug=True`, `eval()`, SQL via f-strings, JWT with `alg:none`, vulnerable npm dependencies and LLM endpoints without auth or `max_tokens`. The output is a Markdown report of where, what and how to fix, with the number of findings and critical ones. Secrets are masked in it. The `livecheck.py` script checks security headers, cookie flags and whether `.env`, `.git/config` and dumps are reachable on your domain. Claude then adds a manual pass and runs a pre-deploy checklist.
Who it is for. Authors of projects built with an AI assistant who ship a site or API and want to find obvious holes before publishing.
Good fit when
- Before deploying a Next.js or Vite project you must confirm paid API keys did not reach the bundle.
- A committed `.env` or a key in history is suspected in a repository.
- An LLM endpoint is open without auth and the token bill threat must be assessed.
- A deployed site is checked for security headers and exposed `.git` and dumps.
Not a fit when
- A pentest of someone else's site is needed; `livecheck.py` works only on your own domain and asks for confirmation.
- A full security audit with a threat model is required; the skill catches typical mistakes.
- A Supabase or Firebase project without a manual check of RLS and rules; the scanner cannot see them.
Example request
Check my project security with vibe-audit and show the critical findings first.Limitations
The scanner matches patterns and misses logic errors. For Supabase and Firebase it only reminds you to check RLS and rules, and for Python dependencies it suggests `pip-audit`, while it runs `npm audit` itself. The skill is read-only and changes nothing in the project. The domain check makes ordinary GET requests. Cowork and claude.ai need code execution enabled. The checklist in `checklist.md` covers what a script cannot see, such as spending limits and 2FA.
How to disable. Delete the `vibe-audit` folder from the project `.claude/skills/`, from `~/.claude/skills/` or from `~/.agents/skills/` for Codex. Remove `vibe-audit-report.md` by hand.
FAQ
What does the skill check?
Keys in code, `.env` in git, secrets in client variables, CORS `*`, `debug=True`, `eval()`, SQL via f-strings, JWT without expiry, default passwords in docker-compose and open LLM endpoints.
Does it change project files?
No. The skill is read-only and secrets in the report appear masked.
Can I run it without Claude?
Yes. `audit.py` is a plain dependency-free Python script: `python3 skills/vibe-audit/scripts/audit.py /path/to/project`.
How do I check a live site?
Run `python3 skills/vibe-audit/scripts/livecheck.py https://your-site.com`. The script makes ordinary GET requests and checks only your own domain.
Where does the skill work?
In Claude Code, Cowork and claude.ai, and in Codex as well: the `SKILL.md` format is shared across platforms.
Discussion
No questions or reviews yet.
Related
SkillsSecurity checks for apps an agent wrote: rules for AGENTS.md, a live-site scanner and an audit across 17 vulnerability types
A skill that audits vibe-coded apps: secrets, Supabase RLS, authorization, payments, rate limits, mobile and AI integrations
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
A skill for Claude Code and Codex that finds common vulnerabilities in AI-written code and shows a fix for each
A local MCP server and CLI find vulnerabilities in AI-generated code and drive a scan, fix and rescan loop, no account needed
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
README in short
Cowork and claude.ai get a `dist/vibe-audit.zip` archive, while Claude Code and Codex need only the skill folder. The scripts also run without an agent.