vibesec: Claude Code skill

What it does

Makes Claude write web code the way a bug hunter would want it: no IDOR, XSS, CSRF, SSRF, open redirects or weak JWTs.

The description Claude matches your request against: Secure coding rules for web apps, from a bug hunter's view - access control and IDOR, XSS, CSRF, SSRF, open redirects, file uploads, SQL injection, XXE, path traversal, JWT and GraphQL. Use when writing or reviewing web code that handles user input, logins, permissions, user-supplied URLs, file uploads, XML or database queries, or when the user asks for a security scan of a web app.

When to use it

You're building any web app and want it secure from the first line, not fixed later.

How to start it

Automatic, or /vibesec

Claude loads it by itself when your request matches, so you rarely need the command. The suggester plugin also points it out when it fits.

Install

vibesec is part of the security plugin. Install just that plugin in Claude Code:

/plugin marketplace add iatee/claude-skills
/plugin install security@iatee-skills
/reload-plugins

Or install the whole collection:

/plugin marketplace add iatee/claude-skills
/plugin install all@iatee-skills
/reload-plugins

New to this? Using skills explains what a skill is and how installing works.

Credit

Made by BehiSecc, licensed Apache-2.0. Claude Skills is an unofficial, personal collection, not affiliated with or endorsed by Anthropic.

More in the security plugin

• vibe-security: Audits an app for the holes AI assistants leave: exposed keys, open Supabase or Firebase tables, unchecked auth, client-set prices, missing rate limits.

All skills in the catalog