Vibe Security skill
A skill that audits vibe-coded apps: secrets, Supabase RLS, authorization, payments, rate limits, mobile and AI integrations
- 1,142 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- The skill is instructions and references: it reads project code the agent already sees and runs nothing
- The report may quote secrets it found, so do not forward it to third parties unedited
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/vibe-securityDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The skill is instructions and references: it reads project code the agent already sees and runs nothing
- The report may quote secrets it found, so do not forward it to third parties unedited
This is third-party code. Review the repository files before installing.
What it does
Vibe Security hunts for the typical vulnerabilities AI assistants introduce: hardcoded keys, missing database access policies, prices and roles trusted from client data, tokens in localStorage. The audit runs in nine steps: secrets and environment variables, database access (Supabase RLS, Firebase rules, Convex auth), authentication, rate limiting, payments, mobile, AI integrations, deployment and data access. Reference files live in references/ and load only for the technologies the project uses. Findings go by severity from critical to low, with critical ones placed at the top of the answer. The skill's core principle: everything that comes from the client is checked on the server.
Who it is for. For founders and developers who built a product with an AI assistant and want to check its security before real users arrive.
Good fit when
- The app was built with an assistant and you need to check keys in variables prefixed NEXT_PUBLIC_, VITE_ and EXPO_PUBLIC_ before launch
- A Supabase project needs its RLS policies reviewed: `USING (true)` and missing WITH CHECK
- Stripe payments: check where the price comes from and whether the webhook verifies its signature
- A mobile app stores tokens in AsyncStorage or keeps keys in the JS bundle
- Endpoints for AI, email and auth have no rate limits and no billing caps
Not a fit when
- You need a penetration test of someone else's systems: the skill reviews your own project's code
- You want a review of style and architecture: the instructions say to report genuine security issues only
- You need an automatic scanner in CI: the skill works through your agent and is not a standalone program
- Your stack is far from those the README names (Supabase, Firebase, Convex, Stripe, React Native, Prisma): coverage will be partial
Example request
/vibe-security audit this project before release: keys, Supabase policies, payments and rate limits on the AI endpointsLimitations
The author calls the skill a community resource and invites new patterns, so the list of checks is not exhaustive. The SKILL.md metadata names version 1.0. The quality of the review depends on your agent's model, so critical findings are worth re-checking by hand.
How to disable. Delete the vibe-security folder from the project's .claude/skills/ or ~/.claude/skills/ (for Codex delete the skill folder wherever the install placed it).
FAQ
How do I run a Vibe Security audit in Claude Code?
Install the skill with npx skills add https://github.com/raroque/vibe-security-skill --skill vibe-security and type /vibe-security. It also fires on plain phrases such as "check my code for security issues" or "is this safe?".
What does Vibe Security check in the database?
Disabled Supabase RLS, `USING (true)` policies, missing WITH CHECK, exposed sensitive fields, Firebase `allow: if true` rules and Convex without auth.
Does the skill work in Codex?
Yes. The README gives the same install command with Codex selected, and calls it through $vibe-security or a plain description such as "check my Supabase RLS".
What payment problems does it look for?
Prices submitted by the client, missing webhook signature verification and stale subscription status checks.
How do I install the skill manually?
Copy the vibe-security/ folder into the project's .claude/skills/ or into ~/.claude/skills/ for every project.
Discussion
No questions or reviews yet.
Related
SkillsVibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
VibeKit runs Claude Code, Codex and other CLI agents through a proxy that masks secrets in replies, keeps a log and can hold the agent in Docker
Security and 152-FZ audit skill with rouble risk pricing
axioma-security
A skill for a deep website security and 152-FZ compliance audit: every finding is mapped to a law article and priced in roubles
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| Vibe Security (this entry) | no | 1,142 | |
| VibeSec | no | 1,364 | teaches the agent to write secure code like a bug hunter instead of auditing a finished app across nine areas |
| security-audit | no | 39,716 | an audit from Cloudflare with recon, coverage hunting and independent verification of findings |
| Ship Safe | no | 861 | a security scanner for AI-written code |
README in short
The README says briefly why the skill exists: assistants build features fast but get security wrong. It then covers installation for Claude Code and Codex through npx skills and by hand, how to invoke it and a table of checks in nine categories. It ends with an invitation to contribute and the MIT license.
README badge
Original SKILL.md
--- name: vibe-security description: Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?". license: MIT metadata: author: Chris Raroque version: "1.0" --- Audit code for security vulnerabilities commonly introduced by AI code generation. These issues are prevalent in "vibe-coded" apps — projects built rapidly with AI assistance where security fundamentals get skipped. AI assistants consistently get these patterns wrong, leading to real breaches, stolen API keys, and drained billing accounts. This skill exists to catch those mistakes before they ship. ## The Core Principle Never trust the client. Every price, user ID, role, subscription status, feature flag, and rate limit counter must be validated or enforced server-side. If it exists only in the browser, mobile bundle, or request body, an attacker controls it. ## Audit Process Examine the codebase systematically. For each step, load the relevant reference file only if the codebase uses that technology or pattern. Skip steps that aren't relevant. 1. **Secrets & Environment Variables** — Scan for hardcoded API keys, tokens, or credentials. Check for secrets exposed via client-side env var prefixes (`NEXT_PUBLIC_`, `VITE_`, `EXPO_PUBLIC_`). Verify `.env` is in `.gitignore`. See `references/secrets-and-env.md`. 2. **Database Access Control** — Check Supabase RLS policies, Firebase Security Rules, or Convex auth guards. This is the #1 source of critical vulnerabilities in vibe-coded apps. See `references/database-security.md`. 3. **Authentication & Authorization** — Validate JWT handling, middleware auth, Server Action protection, and session management. See `references/authentication.md`. 4. **Rate Limiting & Abuse Prevention** — Ensure auth endpoints, AI calls, and expensive operations have rate limits. Verify rate limit counters can't be tampered with. See `references/rate-limiting.md`. 5. **Payment Security** — Check for client-side price manipulation, webhook signature verification, and subscription status validation. See `references/payments.md`. 6. **Mobile Security** — Verify secure token storage, API key protection via backend proxy, and deep link validation. See `references/mobile.md`. 7. **AI / LLM Integration** — Check for exposed AI API keys, missing usage caps, prompt injection vectors, and unsafe output rendering. See `references/ai-integration.md`. 8. **Deployment Configuration** — Verify production settings, security headers, source map exposure, and environment separation. See `references/deployment.md`. 9. **Data Access & Input Validation** — Check for SQL injection, ORM misuse, and missing input validation. See `references/data-access.md`.