Vibe Security
If you're shipping AI-generated code fast, this catches the security holes that LLMs consistently miss. It audits for exposed API keys, client-controlled pricing, disabled database rules (Supabase RLS, Firebase), and broken auth patterns. The approach is practical: it flags only real exploits, shows before/after fixes, and prioritizes by actual impact. Especially useful if you're building with Next.js, Supabase, Stripe, or LLM integrations where one wrong environment variable prefix can leak your service role key. Run it before deploy or when someone asks "is this safe?" It's opinionated about server-side validation, which is the right call for vibe-coded apps.
- skills.sh installs
- 3.8K
- GitHub stars
- 1.2K
- last updated
- Aug 21, 2026
Install
$ npx -y skills add raroque/vibe-security-skill --skill vibe-security --agent claude-codeInstalls into .claude/skills of the current project.
Files
Audit code for security vulnerabilities commonly introduced by AI code generation. These issues are prevalent in "vibe-coded" apps — projects built rapidly with AI assistance where security fundamentals get skipped.
AI assistants consistently get these patterns wrong, leading to real breaches, stolen API keys, and drained billing accounts. This skill exists to catch those mistakes before they ship.
The Core Principle
Never trust the client. Every price, user ID, role, subscription status, feature flag, and rate limit counter must be validated or enforced server-side. If it exists only in the browser, mobile bundle, or request body, an attacker controls it.
Audit Process
Examine the codebase systematically. For each step, load the relevant reference file only if the codebase uses that technology or pattern. Skip steps that aren't relevant.
- Secrets & Environment Variables — Scan for hardcoded API keys, tokens, or credentials. Check for secrets exposed via client-side env var prefixes (
NEXT_PUBLIC_,VITE_,EXPO_PUBLIC_). Verify.envis in.gitignore. Seereferences/secrets-and-env.md.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/raroque/vibe-security-skill
- Categories
- Backend & APIs, Security, Git & Pull Requests, Documentation, Code Review & Quality, Finance & Trading, Databases
- First seen
- Apr 16, 2026
Recommended
More Backend & APIs
open-sourcebrowser-use/browser-useDocumentation reference for writing Python code using the browser-use open-source library. Use this skill whenever the user needs help with Agent, Browser, or T3.7Kskills.sh installs
spring-boot-project-creatorgiuseppe-trisciuoglio/developer-kitCreates and scaffolds a new Spring Boot project (3.x or 4.x) by downloading from Spring Initializr, generating package structure (DDD or Layered architecture), 3.7Kskills.sh installs
deploying-ui-bundleforcedotcom/sf-skillsMUST activate when the project contains a uiBundles/*/src/ directory or sfdx-project.json and the task involves deploying, pushing to an org, or post-deploy set3.6Kskills.sh installs
unauthorized-access-common-servicesyaklang/hack-skillsUnauthorized access playbook for common exposed services. Use when Redis, Rsync, PHP-FPM, AJP/Ghostcat, Hadoop YARN, H2 Console, or similar management interface3.6Kskills.sh installs
workosworkos/skillsUse when the user asks for a WorkOS docs URL, term, or dashboard field (Sign-in endpoint, initiate_login_uri, Redirect URI, `WORKOS_*` env vars), or is implemen3.6Kskills.sh installsusing-ui-bundle-salesforce-dataforcedotcom/sf-skillsMUST activate when the project contains a uiBundles/*/src/ directory and the task involves ANY Salesforce record operation — reading, creating, updating, or del3.6Kskills.sh installs