Menu

#763 by GitHub stars

raroque/vibe-security-skill

Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skil

EngineeringSecurity

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

vibe-security/SKILL.md

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

850938f20f69 → 850938f20f69

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 850938f20f69

No earlier version was observed for comparison.

Compare on GitHub

View on GitHubAdd to my skills

Verified commit 850938f20f6915e7c3688d85c0a838f7909c87bb

1.2kGitHub stars
29stars in 7 days
1skill in this repository
0commits in 30 days

Heat

6.5
  • Star growth, last 7 daysAhead of 93% of tracked repositories
  • Star growth, last 24 hoursAhead of 95% of tracked repositories
  • Rank movement, last 7 daysAhead of 68% of tracked repositories
  • Commits, last 30 daysAhead of 0% of tracked repositories
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekAhead of 0% of tracked repositories

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Aug 2, 2026Nov 6, 20261,214

Individual skills in this repository

How it works

vibe-security

When your agent uses it

Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

What it loads into context

Frontmatter

173 tokens

Always available to the agent

SKILL.md

1,473 tokens

When the skill is activated

Reference documents

5,734 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

  1. The Core Principle
  2. Audit Process
  3. Core Instructions
  4. Output Format
  5. When Generating Code
  6. References

Files

  • SKILL.mdcore7,041 bytes
  • SKILL.mdcore7,041 bytes
  • SKILL.mdcore7,041 bytes
  • agents/openai.yamlasset274 bytes
  • references/ai-integration.mddoc2,474 bytes
  • references/authentication.mddoc3,388 bytes
  • references/data-access.mddoc2,567 bytes
  • references/database-security.mddoc5,406 bytes
  • references/deployment.mddoc2,095 bytes
  • references/mobile.mddoc2,537 bytes
  • references/payments.mddoc2,523 bytes
  • references/rate-limiting.mddoc2,297 bytes
  • references/secrets-and-env.mddoc2,141 bytes
Read SKILL.md

Audit code for security vulnerabilities commonly introduced by AI code generation. These issues are prevalent in "vibe-coded" apps — projects built rapidly with AI assistance where security fundamentals get skipped.

AI assistants consistently get these patterns wrong, leading to real breaches, stolen API keys, and drained billing accounts. This skill exists to catch those mistakes before they ship.


## The Core Principle

Never trust the client. Every price, user ID, role, subscription status, feature flag, and rate limit counter must be validated or enforced server-side. If it exists only in the browser, mobile bundle, or request body, an attacker controls it.


## Audit Process

Examine the codebase systematically. For each step, load the relevant reference file only if the codebase uses that technology or pattern. Skip steps that aren't relevant.
View the complete source on GitHub

Skills included

  • vibe-security

Repository facts

License
MIT
Created
Mar 15, 2026
Last pushed
Mar 15, 2026
Forks
138
Open issues
2
Project activity
Slowing

Rank over the last 12 weeks

Now #763 · best #577 · down 109 in 30 days

  1. #763 on Oct 31
  2. #764 on Nov 1
  3. #765 on Nov 2
  4. #769 on Nov 3
  5. #767 on Nov 4
  6. #763 since Nov 5
74 earlier periods
  1. #577 on Aug 2
  2. #568 on Aug 7
  3. #562 on Aug 8
  4. #568 on Aug 9
  5. #596 on Aug 10
  6. #597 on Aug 11
  7. #593 on Aug 12
  8. #603 on Aug 13
  9. #596 on Aug 14
  10. #577 on Aug 15
  11. #589 on Aug 16
  12. #591 on Aug 17
  13. #608 on Aug 18
  14. #594 on Aug 19
  15. #597 on Aug 20
  16. #602 on Aug 21
  17. #578 on Aug 22
  18. #608 on Aug 23
  19. #614 on Aug 24
  20. #624 on Aug 25
  21. #606 on Aug 26
  22. #617 on Aug 27
  23. #633 on Aug 28
  24. #591 on Aug 29
  25. #590 on Aug 30
  26. #614 on Aug 31
  27. #627 on Sep 1
  28. #616 on Sep 2
  29. #599 on Sep 5
  30. #608 on Sep 6
  31. #618 on Sep 7
  32. #635 on Sep 8
  33. #632 on Sep 10
  34. #618 on Sep 11
  35. #620 on Sep 12
  36. #621 on Sep 13
  37. #644 on Sep 14
  38. #646 on Sep 16
  39. #645 from Sep 17 to Sep 18
  40. #650 on Sep 21
  41. #662 on Sep 23
  42. #635 on Sep 24
  43. #627 on Sep 25
  44. #622 on Sep 26
  45. #643 on Sep 27
  46. #648 on Sep 28
  47. #682 on Sep 29
  48. #660 on Sep 30
  49. #630 on Oct 1
  50. #637 on Oct 2
  51. #615 on Oct 3
  52. #634 on Oct 4
  53. #640 on Oct 5
  54. #654 on Oct 7
  55. #686 on Oct 8
  56. #666 on Oct 9
  57. #656 on Oct 10
  58. #651 on Oct 11
  59. #667 on Oct 12
  60. #664 on Oct 13
  61. #678 on Oct 14
  62. #670 on Oct 15
  63. #680 on Oct 16
  64. #656 on Oct 17
  65. #650 on Oct 18
  66. #684 on Oct 19
  67. #701 on Oct 21
  68. #681 on Oct 22
  69. #677 on Oct 23
  70. #651 on Oct 24
  71. #746 on Oct 25
  72. #753 on Oct 28
  73. #756 on Oct 29
  74. #762 on Oct 30

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 3, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 2 notes
  • vibe-security/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
  • vibe-security/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
Show all 12 signals by file

vibe-security/SKILL.md

  • Access to secretsline 76
    [Credential-related source omitted]
  • Access to secretsline 79
    [Credential-related source omitted]

vibe-security/references/ai-integration.md

  • Access to secretsline 7
    [Credential-related source omitted]

vibe-security/references/deployment.md

  • Network accessline 5
    - **Disable debug mode** in production. Debug pages often leak stack traces, environment variables, and internal paths. - **Disable source maps** in production. Source maps expose your entire source code to anyone who opens DevTools. - **Ve
  • Network accessline 7
    - **Verify `.git` directory is not accessible** in production. If `https://yoursite.com/.git/HEAD` returns content, your entire source code and commit history (including any secrets ever committed) are exposed.

vibe-security/references/mobile.md

  • Network accessline 14
    // BAD: API key in the mobile app const response = await fetch('https://api.openai.com/v1/chat/completions', {
  • Network accessline 15
    const response = await fetch('https://api.openai.com/v1/chat/completions', {
  • Access to secretsline 16
    [Credential-related source omitted]
  • Network accessline 19
    // GOOD: call your own backend, which holds the key const response = await fetch('https://your-api.com/ai/chat', {
  • Network accessline 20
    const response = await fetch('https://your-api.com/ai/chat', {
  • Access to secretsline 28
    [Credential-related source omitted]
  • Access to secretsline 35
    [Credential-related source omitted]

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

Signal confidence: 2 facts
  • Access to secrets in code of the SKILL.md: a variable, placeholder or call, not a stored valuevibe-security/SKILL.md:76Low confidence
  • Access to secrets in code of the SKILL.md: a variable, placeholder or call, not a stored valuevibe-security/SKILL.md:79Low confidence

Works with

Agent compatibility, from the files in this repository
AgentStatusEvidenceInstall to
Claude CodeCompatibleStandard SKILL.md vibe-security/SKILL.md.claude/skills/<skill-name>/
CodexCompatibleStandard SKILL.md vibe-security/SKILL.md.agents/skills/<skill-name>/
CursorCompatibleStandard SKILL.md vibe-security/SKILL.md.cursor/skills/<skill-name>/
Gemini CLICompatibleStandard SKILL.md vibe-security/SKILL.md.gemini/skills/<skill-name>/
GitHub CopilotCompatibleStandard SKILL.md vibe-security/SKILL.md.github/skills/<skill-name>/
OpenCodeCompatibleStandard SKILL.md vibe-security/SKILL.md.opencode/skills/<skill-name>/
  • Native The repository ships a manifest, folder or frontmatter field for this agent.
  • Compatible A standard SKILL.md that this agent can read.
  • Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

You might also use

mattpocock/skills

Skills for Real Engineers. Straight from my .agents directory.

316kGitHub stars

obra/superpowers

An agentic skills framework & software development methodology that works.

313.3kGitHub stars

NousResearch/hermes-agent

The agent that grows with you

261kGitHub stars

multica-ai/andrej-karpathy-skills

Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions,…

230kGitHub stars

anthropics/skills

Public repository for Agent Skills

187.9kGitHub stars

DietrichGebert/ponytail

Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.

185.5kGitHub stars

Explore alternatives and comparisons

Add this badge to your README

It updates every night and links to this page.

raroque/vibe-security-skill: #763 on hotskills, 1.2k stars

[![raroque/vibe-security-skill on hotskills](https://hotskills.dev/badge/raroque-vibe-security-skill.svg)](https://hotskills.dev/skill/raroque-vibe-security-skill/)