vibe-security

The vibe-security skill audits codebases for common security vulnerabilities that AI coding assistants frequently introduce when building applications rapidly. It specifically targets issues prevalent in "vibe-coded" projects — applications developed quickly with AI assistance where security fundamentals are often overlooked or skipped. This skill exists because AI assistants consistently produce insecure patterns that lead to real-world breaches, exposed API keys, and compromised billing accounts.

The skill performs systematic security audits across nine critical areas: secrets and environment variables, database access control (Supabase RLS, Firebase rules), authentication and authorization, rate limiting, payment security, mobile security, AI/LLM integration security, deployment configuration, and data access patterns. It operates on the core principle that clients can never be trusted — all prices, user IDs, roles, subscription statuses, and access controls must be validated server-side. The skill uses modular reference files to examine only relevant technologies actually present in the codebase, making audits efficient and focused.

This skill is designed for developers building web and mobile applications with modern frameworks, particularly those using AI assistance for rapid development. It's especially valuable when working with authentication systems, payment integrations, database access layers, or any code handling user data and secrets. The skill can be invoked proactively during code generation to prevent vulnerabilities from being introduced, or reactively when users request security reviews, code audits, or ask questions like "is this safe?" or "can someone hack this?"