# vibe-security-skill

Audits code written with an AI assistant for the usual holes: exposed keys, broken RLS policies, weak auth.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1100 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/vibe-security-skill/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/vibe-security-skill

## What it does

The skill scans a codebase for vulnerability patterns that AI coding assistants tend to leave behind. It ships technology-specific reference files, so only the parts of your stack that actually exist get checked: Supabase, Stripe, React Native and others.

What it catches: secrets and API keys sitting in source, Row-Level Security that is off or missing, insecure auth flows, payment amounts submitted by the client, no rate limiting, tokens kept in `localStorage`, secrets leaking into mobile bundles, AI API keys with no usage cap.

It activates on its own while you work on auth, payments, database queries, API key setup, user data handling and environment variables. In Claude you can also call it directly with `/vibe-security`. This is a pattern check, not a full architecture review.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill vibe-security-skill -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/vibe-security-skill/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/vibe-security-skill/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill vibe-security-skill -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/vibe-security-skill/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill vibe-security-skill -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/vibe-security-skill/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills vibe-security-skill
```

2. **Manually: put the files in place**
- File: `.github/skills/vibe-security-skill/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill vibe-security-skill -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/vibe-security-skill
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/vibe-security-skill/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill vibe-security-skill -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/vibe-security-skill/SKILL.md

## When to use it
- find secrets left in the source tree
- confirm RLS is on and policies are not wide open
- make sure the server sets the payment amount, not the client
- catch tokens stored in `localStorage`
- check rate limits on expensive AI endpoints

## Example prompts
- Audit my code for security issues
- Is this payment flow secure?
- Review my Supabase RLS policies

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 24 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md