vibe-security: Claude Code skill

What it does

Audits an app for the holes AI assistants leave: exposed keys, open Supabase or Firebase tables, unchecked auth, client-set prices, missing rate limits.

The description Claude matches your request against: Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security or a security review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

When to use it

You built an app with AI and want to know if someone could break in before you ship it.

How to start it

Automatic, or /vibe-security

Claude loads it by itself when your request matches, so you rarely need the command. The suggester plugin also points it out when it fits.

Install

vibe-security is part of the security plugin. Install just that plugin in Claude Code:

/plugin marketplace add iatee/claude-skills
/plugin install security@iatee-skills
/reload-plugins

Or install the whole collection:

/plugin marketplace add iatee/claude-skills
/plugin install all@iatee-skills
/reload-plugins

New to this? Using skills explains what a skill is and how installing works.

Credit

Made by Chris Raroque, licensed MIT. Claude Skills is an unofficial, personal collection, not affiliated with or endorsed by Anthropic.

More in the security plugin

• vibesec: Makes Claude write web code the way a bug hunter would want it: no IDOR, XSS, CSRF, SSRF, open redirects or weak JWTs.

All skills in the catalog