Vibe 安全审计 Skill

★ 913Polish in Practice

#security#audit#skill

Overview

An agent skill that helps secure vibe-coded apps from the security vulnerability patterns that keep recurring (913+ stars). Built by Chris Raroque with the team at Aloa, it stems from the observation that AI assistants build features fast but consistently get security wrong — hardcoding secrets, skipping row-level security, trusting client-submitted prices, storing tokens in localStorage. This skill gives your agent the knowledge to catch those patterns before they ship.

Who it's for

Developers building apps with Claude Code, OpenAI Codex or similar AI assistants — especially anything touching auth, payments, database access, AI APIs or user data — who want the AI to close security holes as part of writing the code.

What you'll learn

01What it audits: the vulnerabilities AI assistants keep introducing
Rules load by technology stack so no context is wasted: Supabase → RLS policies, Stripe → payment flows, React Native → secrets in the JS bundle. Nine categories: secrets & env vars (hardcoded API keys, NEXT_PUBLIC_/VITE_ exposure, missing .gitignore), database security (disabled Supabase RLS, USING (true), missing WITH CHECK, Firebase allow: if true), auth & authorization (jwt.decode() without verify, middleware-only auth, unprotected Server Actions), rate limiting, payments (client-submitted prices, missing webhook signature verification), mobile (tokens in AsyncStorage, API keys in the bundle), AI/LLM (exposed keys, no usage caps, prompt injection, unsafe output rendering), deployment (debug mode in production, exposed source maps, accessible .git), and data access (SQL injection, Prisma operator injection, $queryRawUnsafe).
02Why vibe-coded apps especially need security audits
When you build fast with AI, security fundamentals get skipped — and the AI assistants themselves are often the ones introducing the vulnerabilities. That's the skill's starting point: not an extra check layered on top, but giving the agent the knowledge to recognize these anti-patterns in the first place. It's positioned as a community resource, and contributors are encouraged to keep adding the security anti-patterns AI keeps producing.
03How to use it: one-shot audit or natural language
Once installed, trigger a full security audit in Claude Code with /vibe-security, or just ask naturally — 'check my code for security issues', 'is this safe?', 'audit this project'. In Codex, use $vibe-security or describe what you need. The skill also activates automatically when you're writing or reviewing code that handles authentication, payments, database access, API keys, or user data — no manual invocation needed each time.
04How to install: works with Claude Code and Codex
The official path is a one-liner: npx skills add https://github.com/raroque/vibe-security-skill --skill vibe-security — select 'Codex' when prompted if installing for Codex. Manual install is also supported: copy the vibe-security/ folder into a project-level .claude/skills/ or the global ~/.claude/skills/. It uses the Agent Skills format, so it works with Claude Code, OpenAI Codex and other compatible agents.

Practice tips

Install the skill in your project, run /vibe-security once, and triage the report into secrets / auth / payments / data-access buckets — fixing hardcoded keys first.
If you use Supabase or Firebase, specifically ask the agent to verify RLS/rules actually take effect rather than just confirming the database is reachable.
Make security audit a fixed pre-launch step: run it before every deploy, paying special attention to new payment, auth or AI-integration code.
When AI keeps introducing a new security mistake, add it to the skill per CONTRIBUTING so this community resource grows with your real-world practice.