Skip to main content
affpapa.org
RU EN
skill CX Codex

vibe-security-skill — Claude Code skill: security audit

Audits code written with an AI assistant for the usual holes: exposed keys, broken RLS policies, weak auth.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill vibe-security-skill -a claude-code
Open on GitHub

What vibe-security-skill does

The skill scans a codebase for vulnerability patterns that AI coding assistants tend to leave behind. It ships technology-specific reference files, so only the parts of your stack that actually exist get checked: Supabase, Stripe, React Native and others.

What it catches: secrets and API keys sitting in source, Row-Level Security that is off or missing, insecure auth flows, payment amounts submitted by the client, no rate limiting, tokens kept in localStorage, secrets leaking into mobile bundles, AI API keys with no usage cap.

It activates on its own while you work on auth, payments, database queries, API key setup, user data handling and environment variables. In Claude you can also call it directly with /vibe-security. This is a pattern check, not a full architecture review.

What it helps with

  • find secrets left in the source tree
  • confirm RLS is on and policies are not wide open
  • make sure the server sets the payment amount, not the client
  • catch tokens stored in localStorage
  • check rate limits on expensive AI endpoints

Example prompts for the agent

  • Audit my code for security issues
  • Is this payment flow secure?
  • Review my Supabase RLS policies

How to install vibe-security-skill

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill vibe-security-skill -a claude-code

2Manually: put the files in place

~/.claude/skills/vibe-security-skill/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/vibe-security-skill/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about vibe-security-skill

How do I install vibe-security-skill in Claude Code?

Run npx skills add reason-machines/security-skills --skill vibe-security-skill -a claude-code. The skill lands at ~/.claude/skills/vibe-security-skill/SKILL.md.

What does vibe-security-skill do?

It looks for common vulnerabilities in apps built with an AI assistant: exposed secrets, RLS gaps, weak authentication, unsafe payment handling.

When does the skill activate on its own?

While you work on authentication, payments, database queries, API key configuration, user data or environment variables. In Claude you can also trigger it with /vibe-security.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set24

report-malicious-repository Flags repositories that pose as antivirus or other commercial software and walks you through filing a GitHub report. CX Codex +1 1,100installs avast-security-awareness Trains your agent to flag repositories posing as antivirus tools or cracked software, and to warn you before anything gets downloaded. CX Codex +1 1,100installs avast-premium-security-analysis A skill for studying Avast Premium Security components and antivirus protection mechanisms. Useful when you take apart defensive software inside an isolated environment. CX Codex +1 1,100installs malware-warning-avast-keygen This skill spots repositories posing as an Avast Premium Security crack or keygen and explains why nothing from them should be run. CX Codex +1 1,100installs security-threat-awareness Flags repositories that disguise malicious downloads as legitimate security tools. Use it before installing software from GitHub. CX Codex +1 1,000installs malware-analysis-dragonflyTomb-avast A skill for pulling apart repositories that pose as antivirus installers. It helps you tell a fake distribution from the real thing. CX Codex +1 1,000installs avast-premium-security-awareness A skill that flags repositories posing as antivirus software while actually pushing malware. CX Codex +1 1,000installs avast-premium-security-malware-detection This skill inspects suspicious repositories posing as antivirus installers and points out where malware distribution starts. CX Codex +1 989installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor