vibe-security

vibe security

raroque 877 ↓ 2.3k MIT updated 5mo ago

Claude Code

View source ↗

What it does

Report only genuine security issues. Do not nitpick style or non-security concerns.
When multiple issues exist, prioritize by exploitability and real-world impact.
If the codebase doesn't use a particular technology (e.g., no Supabase), skip that section entirely.
When generating new code, consult the relevant reference files proactively to avoid introducing vulnerabilities in the first place.
If you find a critical issue (exposed secrets, disabled RLS, auth bypass), flag it immediately at the top of your response — don't bury it in a long list.
references/secrets-and-env.md — API keys, tokens, environment variable configuration, and .gitignore rules.
references/database-security.md — Supabase RLS, Firebase Security Rules, and Convex auth patterns.

Requirements & configuration

6. Mobile Security — Verify secure token storage, API key protection via backend proxy, and deep link validation. See references/mobile.md.
references/ai-integration.md — LLM API key protection, usage caps, prompt injection, and output sanitization.

Configuration: NEXT_PUBLIC_VITE_EXPO_PUBLIC_

Derived from the skill's own SKILL.md documentation · extracted 2026-07-23

vibe security

Source

Repository: https://github.com/raroque/vibe-security-skill

vibe-security FAQ

What does the vibe-security skill do?

Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?". Report only genuine security issues. Do not nitpick style or non-security concerns. When multiple issues exist, prioritize by exploitability and real-world impact.

What does vibe-security require?

6. Mobile Security — Verify secure token storage, API key protection via backend proxy, and deep link validation. See references/mobile.md. references/ai-integration.md — LLM API key protection, usage caps, prompt injection, and output sanitization. Configuration keys: NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_.

How do I install vibe-security?

Run: npx -y skills add https://github.com/raroque/vibe-security-skill --skill vibe-security --agent claude-code — the source lives at github.com/raroque/vibe-security-skill.

Maintain vibe-security?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[vibe-security on getagentictools](https://getagentictools.com/skills/raroque-vibe-security-skill-vibe-security?ref=badge)

npx agentictools info skills/raroque-vibe-security-skill-vibe-security

The second line is the CLI lookup for this page — handy in READMEs and docs.