Menu

#690 by GitHub stars

BehiSecc/VibeSec-Skill

This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.

Engineering

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

SKILL.md

Week of Oct 26, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

0590993b35ad → 0590993b35ad

Compare on GitHub

View on GitHubAdd to my skills

Verified commit 0590993b35ad51961f65a4d01cf1196dfead05bb

1.4kGitHub stars
3stars in 7 days
1skill in this repository
0commits in 30 days

Heat

4.2
  • Star growth, last 7 daysAhead of 59% of tracked repositories
  • Star growth, last 24 hoursAhead of 91% of tracked repositories
  • Rank movement, last 7 daysAhead of 16% of tracked repositories
  • Commits, last 30 daysAhead of 0% of tracked repositories
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekAhead of 0% of tracked repositories

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Aug 2, 2026Nov 6, 20261,382

Individual skills in this repository

How it works

VibeSec-Skill

When your agent uses it

This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.

What it loads into context

Frontmatter

44 tokens

Always available to the agent

SKILL.md

5,791 tokens

When the skill is activated

Reference documents

1,067 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

  1. Overview
  2. Access Control Issues
  3. Client-Side Bugs
  4. Open Redirect
  5. Server-Side Bugs
  6. Security Headers Checklist
  7. JWT Security
  8. API Security
  9. General Security Principles

Files

  • LICENSEasset11,357 bytes
  • README.mddoc4,310 bytes
  • SKILL.mdcore24,779 bytes
  • SKILL.mdcore24,779 bytes
  • SKILL.mdcore24,779 bytes
  • SKILL.mdcore24,779 bytes
  • SKILL.mdcore24,779 bytes
  • SKILL.mdcore24,779 bytes
  • SKILL.mdcore24,779 bytes
Read SKILL.md

# Secure Coding Guide for Web Applications

## Overview

This guide provides comprehensive secure coding practices for web applications. As an AI assistant, your role is to approach code from a **bug hunter's perspective** and make applications **as secure as possible** without breaking functionality.

**Key Principles:**
- Defense in depth: Never rely on a single security control
- Fail securely: When something fails, fail closed (deny access)
- Least privilege: Grant minimum permissions necessary
- Input validation: Never trust user input, validate everything server-side
- Output encoding: Encode data appropriately for the context it's rendered in

---
View the complete source on GitHub

Skills included

  • VibeSec-Skill

Repository facts

License
Apache-2.0
Created
Feb 2, 2026
Last pushed
Feb 17, 2026
Forks
124
Open issues
2
Project activity
Slowing

Rank over the last 12 weeks

Now #690 · best #488 · down 111 in 30 days

  1. #676 on Oct 31
  2. #678 on Nov 1
  3. #683 on Nov 2
  4. #686 on Nov 3
  5. #688 on Nov 4
  6. #690 since Nov 5
73 earlier periods
  1. #500 on Aug 2
  2. #525 on Aug 6
  3. #499 from Aug 8 to Aug 9
  4. #518 on Aug 10
  5. #517 on Aug 11
  6. #513 on Aug 12
  7. #517 on Aug 13
  8. #510 on Aug 14
  9. #488 on Aug 15
  10. #498 on Aug 16
  11. #502 on Aug 17
  12. #518 on Aug 18
  13. #510 on Aug 19
  14. #509 on Aug 20
  15. #511 on Aug 21
  16. #494 on Aug 22
  17. #516 on Aug 23
  18. #517 on Aug 24
  19. #529 on Aug 25
  20. #519 on Aug 26
  21. #530 on Aug 27
  22. #528 on Aug 28
  23. #513 on Aug 29
  24. #503 on Aug 30
  25. #528 on Aug 31
  26. #531 on Sep 1
  27. #526 on Sep 2
  28. #530 on Sep 3
  29. #514 on Sep 4
  30. #508 on Sep 5
  31. #522 on Sep 6
  32. #524 on Sep 7
  33. #543 on Sep 8
  34. #535 on Sep 10
  35. #523 on Sep 12
  36. #525 on Sep 13
  37. #545 on Sep 14
  38. #533 on Sep 15
  39. #545 on Sep 16
  40. #530 on Sep 19
  41. #544 on Sep 20
  42. #545 on Sep 21
  43. #556 on Sep 22
  44. #549 on Sep 23
  45. #536 on Sep 24
  46. #531 on Sep 25
  47. #556 on Sep 27
  48. #558 on Sep 28
  49. #581 on Sep 29
  50. #570 on Sep 30
  51. #558 on Oct 1
  52. #563 on Oct 2
  53. #545 on Oct 3
  54. #575 on Oct 6
  55. #579 on Oct 7
  56. #602 on Oct 8
  57. #592 on Oct 9
  58. #588 on Oct 12
  59. #590 on Oct 13
  60. #601 on Oct 14
  61. #600 on Oct 15
  62. #602 on Oct 16
  63. #586 on Oct 17
  64. #581 on Oct 18
  65. #602 on Oct 19
  66. #613 on Oct 20
  67. #620 on Oct 21
  68. #599 on Oct 23
  69. #591 on Oct 24
  70. #662 on Oct 25
  71. #669 on Oct 28
  72. #672 on Oct 29
  73. #674 on Oct 30

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 3, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 6 notes
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • No broad tool permissions
  • 1 dangerous shell commandin 1 file: SKILL.md:430
  • 47 network referencesin 3 files: SKILL.md:125 README.md:31 LICENSE:1
  • No hidden or obfuscated text
  • No instruction overrides
  • No executable scripts
  • 1 reference to secretsin 1 file: SKILL.md:665
  • No requests to vote in Hot
Show all 49 signals by file

LICENSE

  • Network accessline 1
    Apache License                            Version 2.0, January 2004                         http://www.apache.org/licenses/
  • Network accessline 3
    http://www.apache.org/licenses/
  • Network accessline 195
    http://www.apache.org/licenses/LICENSE-2.0

README.md

  • Network accessline 31
    >[!Tip] >This skill already covers 60-70% of the common vulnerabilities. However, if you need a more robust version with more vulnerability coverage, please visit [vibesec.sh](https://vibesec.sh/)
  • Network accessline 32
    >This skill already covers 60-70% of the common vulnerabilities. However, if you need a more robust version with more vulnerability coverage, please visit [vibesec.sh](https://vibesec.sh/)
  • Network accessline 39
    * Clone this repository: `git clone https://github.com/BehiSecc/VibeSec-Skill`
  • Network accessline 46
    * Clone this repository: `git clone https://github.com/BehiSecc/VibeSec-Skill`
  • Network accessline 53
    * Clone this repository: `git clone https://github.com/BehiSecc/VibeSec-Skill`
  • Network accessline 61
    * Clone this repository: `git clone https://github.com/BehiSecc/VibeSec-Skill`
  • Network accessline 69
    * Clone this repository: `git clone https://github.com/BehiSecc/VibeSec-Skill`
  • Network accessline 131
    If you want to contact me, you can reach me on [X](https://x.com/Behi_Sec).

SKILL.md

  • Network accessline 125
    img-src 'self' data: https:;      font-src 'self';      connect-src 'self' https://api.yourdomain.com;
  • Network accessline 126
    font-src 'self';      connect-src 'self' https://api.yourdomain.com;      frame-ancestors 'none';
  • Network accessline 127
    connect-src 'self' https://api.yourdomain.com;
  • Network accessline 283
    | Technique | Example | Why It Works | |-----------|---------|--------------| | @ symbol | `https://legit.com@evil.com` | Browser navigates to evil.com with legit.com as username |
  • Network accessline 284
    |-----------|---------|--------------| | @ symbol | `https://legit.com@evil.com` | Browser navigates to evil.com with legit.com as username | | Subdomain abuse | `https://legit.com.evil.com` | evil.com owns the subdomain |
  • Network accessline 285
    | @ symbol | `https://legit.com@evil.com` | Browser navigates to evil.com with legit.com as username |
  • Network accessline 286
    | Subdomain abuse | `https://legit.com.evil.com` | evil.com owns the subdomain |
  • Network accessline 287
    | Protocol tricks | `javascript:alert(1)` | XSS via redirect | | Double URL encoding | `%252f%252fevil.com` | Decodes to `//evil.com` after double decode | | Backslash | `https://legit.com\@evil.com` | Some parsers normalize `\` to `/` |
  • Network accessline 288
    | Double URL encoding | `%252f%252fevil.com` | Decodes to `//evil.com` after double decode | | Backslash | `https://legit.com\@evil.com` | Some parsers normalize `\` to `/` | | Null byte | `https://legit.com%00.evil.com` | Some parsers trun
  • Network accessline 289
    | Backslash | `https://legit.com\@evil.com` | Some parsers normalize `\` to `/` |
  • Network accessline 290
    | Null byte | `https://legit.com%00.evil.com` | Some parsers truncate at null |
  • Network accessline 291
    | Tab/newline | `https://legit.com%09.evil.com` | Whitespace confusion |
  • Network accessline 292
    | Unicode normalization | `https://legіt.com` (Cyrillic і) | IDN homograph attack |
  • Network accessline 293
    | Data URLs | `data:text/html,<script>...` | Direct payload execution | | Protocol-relative | `//evil.com` | Uses current page's protocol | | Fragment abuse | `https://legit.com#@evil.com` | Parsed differently by different libraries |
  • Network accessline 295
    | Fragment abuse | `https://legit.com#@evil.com` | Parsed differently by different libraries |
  • Network accessline 351
    | Technique | Example | Description | |-----------|---------|-------------| | Decimal IP | `http://2130706433` | 127.0.0.1 as decimal |
  • Network accessline 352
    |-----------|---------|-------------| | Decimal IP | `http://2130706433` | 127.0.0.1 as decimal | | Octal IP | `http://0177.0.0.1` | Octal representation |
  • Network accessline 353
    | Decimal IP | `http://2130706433` | 127.0.0.1 as decimal |
  • Network accessline 354
    | Octal IP | `http://0177.0.0.1` | Octal representation |
  • Network accessline 355
    | Hex IP | `http://0x7f.0x0.0x0.0x1` | Hexadecimal |
  • Network accessline 356
    | IPv6 localhost | `http://[::1]` | IPv6 loopback |
  • Network accessline 357
    | IPv6 mapped IPv4 | `http://[::ffff:127.0.0.1]` | IPv4-mapped IPv6 |
  • Network accessline 358
    | Short IPv6 | `http://[::]` | All zeros |
  • Network accessline 359
    | DNS rebinding | Attacker's DNS returns internal IP | First request resolves to external IP, second to internal | | CNAME to internal | Attacker domain CNAMEs to internal | DNS points to internal hostname | | URL parser confusion | `http:/
  • Network accessline 360
    | CNAME to internal | Attacker domain CNAMEs to internal | DNS points to internal hostname | | URL parser confusion | `http://attacker.com#@internal` | Different parsing behaviors | | Redirect chains | External URL redirects to internal | F
  • Network accessline 361
    | URL parser confusion | `http://attacker.com#@internal` | Different parsing behaviors |
  • Network accessline 362
    | Redirect chains | External URL redirects to internal | Follow redirects carefully | | IPv6 scope ID | `http://[fe80::1%25eth0]` | Interface-scoped IPv6 | | Rare IP formats | `http://127.1` | Shortened IP notation |
  • Network accessline 363
    | IPv6 scope ID | `http://[fe80::1%25eth0]` | Interface-scoped IPv6 |
  • Network accessline 364
    | Rare IP formats | `http://127.1` | Shortened IP notation |
  • Network accessline 375
    Block access to cloud metadata endpoints: - AWS: `169.254.169.254` - GCP: `metadata.google.internal`, `169.254.169.254`, `http://metadata`
  • Network accessline 376
    - AWS: `169.254.169.254` - GCP: `metadata.google.internal`, `169.254.169.254`, `http://metadata` - Azure: `169.254.169.254`
  • Network accessline 377
    - GCP: `metadata.google.internal`, `169.254.169.254`, `http://metadata`
  • Dangerous shell operationline 430
    | Filename injection | `; rm -rf /` in filename | Sanitize filenames, use random names |
  • Network accessline 527
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
  • Network accessline 528
    dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
  • Network accessline 529
    dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
  • Network accessline 530
    dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
  • Access to secretsline 665
    [Credential-related source omitted]

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Signal confidence: 2 facts
  • Network access in code of the SKILL.mdSKILL.md:127High confidence
  • Access to secrets in code of the SKILL.md: a variable, placeholder or call, not a stored valueSKILL.md:665Low confidence

Works with

Agent compatibility, from the files in this repository
AgentStatusEvidenceInstall to
Claude CodeUnknownNo evidence
CodexUnknownNo evidence
CursorUnknownNo evidence
Gemini CLIUnknownNo evidence
GitHub CopilotUnknownNo evidence
OpenCodeUnknownNo evidence
  • Native The repository ships a manifest, folder or frontmatter field for this agent.
  • Compatible A standard SKILL.md that this agent can read.
  • Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

You might also use

obra/superpowers

An agentic skills framework & software development methodology that works.

313.6kGitHub stars

career-ops-hq/career-ops

Open-source AI job search agent and job finder: scan job boards, score each job 1-5 against your CV before you apply, tailor an ATS-friendly resume and cover letter, get interview…

80.7kGitHub stars

deanpeters/Product-Manager-Skills

Product Management skills framework built on battle-tested methods for Claude Code, Cowork, Codex, and AI agents.

7.9kGitHub stars

sergebulaev/linkedin-skills

Claude skills for LinkedIn. 12 Claude Code and Codex skills that write human-sounding LinkedIn posts, craft comments that get noticed, analyze your feed, and build a publishing ca…

5.7kGitHub stars

rebelytics/one-skill-to-rule-them-all

Monitors task execution for skill improvement opportunities: logs patterns, user corrections and methodology worth preserving to the workspace, turns them into skill updates in a …

3.8kGitHub stars

HUANGCHIHHUNGLeo/claude-real-video

Let Claude (or any LLM) actually watch a video — scene-aware, deduplicated frames + transcript, from a URL or local file. Runs locally, MIT.

2.3kGitHub stars

Explore alternatives and comparisons

Add this badge to your README

It updates every night and links to this page.

BehiSecc/VibeSec-Skill: #690 on hotskills, 1.4k stars

[![BehiSecc/VibeSec-Skill on hotskills](https://hotskills.dev/badge/behisecc-vibesec-skill.svg)](https://hotskills.dev/skill/behisecc-vibesec-skill/)