vibe-security-skill - Agent skill that audits vibe-coded apps for common

项目说明

<p align="center">
<img src=" alt="Security for apps" />
<img src=" alt="MIT License" />
<a href="
<img src=" alt="Twitter: " />
</a>
</p>

<h1 align="center">Vibe Security - Agent Skill for AI Coding Assistants</h1>

An agent skill that helps secure apps - or honestly any app - from common security patterns. Built by Chris Raroque () in collaboration with my colleagues at Aloa.

AI assistants are great at building features fast but consistently get security wrong: hardcoding secrets, skipping row-le, trusting client-submitted prices, storing tokens in localStorage. This skill catches those patterns before they ship.

Need help building AI apps, custom agents, or implementing AI at your company? Work with Chris and the team at Aloa.

Background

This skill was built specifically to address the security issues that keep showing up in applications. When you're building fast with AI, security fundamentals get skipped - and the AI assistants themselves are often the ones introducing the . This skill gives your agent the knowledge to catch and prevent those patterns.

It uses the Agent Skills format, so it works with Claude Code, OpenAI Codex, and other compatible agents.

The security rules are organized as reference files that the agent loads based on what technologies your project uses. If you're using Supabase, it checks RLS policies. If you're using Stripe, it checks payment flows. If you're using React Native, it checks for secrets in the JS bundle. No wasted context on irrelevant checks.

Installing Vibe Security

Claude Code

If npx isn't a, install Node.js first: brew install node (macOS) or download from nodejs.org.

OpenAI Codex

Select "Codex" when prompted for the agent platform.

Manual Installation (Claude Code)

Clone this repo and copy the / folder to your project or global skills directory:

Using Vibe Security

Claude Code: Use / to trigger a full security audit, or just ask naturally - "check my code for security issues", "is this safe?", "audit this project".

Codex: Use $ or describe what you need - "review this for ", "check my Supabase RLS".

The skill also activates automatically when you're writing or re code that handles authentication, payments, database access, API keys, or user data.

What It Checks

| Category | What It Catches |
|----------|----------------|
| Secrets & Env Vars | Hardcoded API keys, secrets in NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_ vars, missing .gitignore |
| Database Security | Disabled Supabase RLS, USING (true) policies, missing WITH CHECK, exposed sensiti, Firebase allow: if true rules, Con auth |
| Auth & Authorization | jwt.decode() without , middleware-only auth, unprotected Ser, tokens in localStorage |
| Rate Limiting | Missing limits on auth/AI/email endpoints, client-tamperable rate counters, no billing caps |
| Payments | Client-submitted prices, missing webhook signature , stale subscription checks |
| Mobile | API keys in JS bundle, AsyncStorage for tokens, unsafe deep links, weak biometric auth |
| AI / LLM | Exposed AI API keys, no usage caps, prompt injection, unsafe output rendering |
| Deployment | Debug mode in production, exposed source maps, missing security headers, .git accessible |
| Data Access | SQL injection, Prisma operator injection, $queryRawUnsafe, mass assignment |

Contributing

Contributions, corrections, and impro are very welcome! This is meant to be a community resource. If you' a security anti-pattern that AI assistants keep introducing, please add it.

See CONTRIBUTING.md for guidelines.

License

Vibe Security is a under the MIT License. See LICENSE for details.

Created by Chris Raroque () and the team at Aloa.

项目信息

开发语言：未知

Star 数：1090

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Agent skill that audits vibe-coded apps for common security vulnerabilities introduced by AI coding assistants展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。