Cheatcode_
Feedback

Catalog / Engineering / Vibe security

Agent skills

Vibe security

Listed by its author as vibe-security-skill

Agent skill that audits vibe-coded apps for common security vulnerabilities introduced by AI coding assistants

by raroque · MIT · 1.2k GitHub stars

DoesSecurityValidation and QACode review

Source on GitHub ↗
curl -fsSL https://api.cheatcodehq.com/install.sh | sh -s -- vibe-security-skill --to all

Copies 1 skill into each app's skills folder (Claude Code: ~/.claude/skills), after checking every file against raroque/vibe-security-skill at commit 850938f. Nothing else on your computer changes. To undo it, run the terminal command with --uninstall at the end; that also removes what the app added.

Then start a new session in your AI app and ask for the work in plain words; it picks the skill from its description. In Claude Code you can also type /vibe-security-skill:vibe-security.

See it in use

One real session, replayed step by step: the request, each step at the moment it happened, and the answer, unedited. Long waits are shown faster, with the real time in the corner. The three code files are invented for this example (Acme Notes, a fictional note-taking app); the security holes are planted and the key is fake.
The result
security-review.mdWhat the session produced: security-review.md, the file the session saved.

A security review ranked from critical to low, with the file and line, what an attacker could do, and a fix for each problem.

security-review.md, the file the session saved.

Open the whole result
Try it

After installing, start a new session and say: Use the vibe-security skill to check my project folder for security holes before launch, worst problems first.

What else it can do, and its limits
  • One skill that audits code an AI assistant wrote, by the rule that nothing from the browser is trusted
  • Covers secrets and env files, Supabase, Firebase and Convex rules, login checks, rate limits and Stripe payments
  • Also checks mobile apps, AI API keys and usage caps, prompt injection, deployment settings and SQL injection
  • Reads only the guides for what your code uses, and applies the same rules when it writes new code
  • Reviews only the files it can see: auth, webhooks or config kept elsewhere are named as not checked
  • Shows each fix as before and after code; in this example it changed nothing, as asked

Sample input Recorded Oct 26, 2026 in Claude Code 2.1.308 with Sonnet 5.5. The video replays that session; nothing in it was acted or edited.

What's inside 1 skill

  • vibe-securityAudits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

    Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

About

Where this comes from. The public repository raroque/vibe-security-skill at commit 850938f, under its MIT license, copied without changes. raroque is not affiliated with Cheatcode and has not claimed this listing yet. New releases are repackaged after review, never synced automatically. If this is your project, write to admin@cheatcodehq.com to claim or remove it.

Something wrong with this listing, or it did not install? Tell us

Versions

v0.0.0-g850938fListed from raroque/vibe-security-skill at 850938f · 2026-09-28