Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
This skill systematically reviews codebases for security vulnerabilities that AI coding tools commonly introduce: exposed API keys, broken Supabase Row-Level Security policies, client-side price manipulation, and missing authentication validation. It is designed for developers building rapidly with AI assistance, helping them catch critical mistakes before they reach production.
WHO IT'S FOR
Vibe-coded app founders
ship rapidly without security reviews
Independent developers
generate code with AI assistants without security expertise
Security-conscious product engineers
review AI-generated code for vulnerabilities
Startup technical leads
establish security practices for AI-assisted development
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
I’m using
Claude Code via npx
Installs: Installs the vibe-security skill using the skills CLI. · Claude Code
Before you start
Node.js with npx must be installed. If npx is unavailable, the author says to install Node.js first; the documented macOS option is `brew install node`, or Node.js can be downloaded from nodejs.org.
Run this terminal command to add the vibe-security skill for Claude Code.
Installs: Installs the vibe-security skill using the skills CLI. · OpenAI Codex
Before you start
Node.js with npx must be installed. If npx is unavailable, the author says to install Node.js first; the documented macOS option is `brew install node`, or Node.js can be downloaded from nodejs.org.
Run this terminal command to add the vibe-security skill.
Use the vibe-security skill to perform a focused security review of [PROJECT_PATH]. Check for hardcoded API keys, tokens, or credentials; secrets exposed through client-side environment-variable prefixes such as NEXT_PUBLIC_, VITE_, or EXPO_PUBLIC_; and whether .env is listed in .gitignore. Report the issues you find and practical remediation guidance. [PROJECT_PATH] is a placeholder for the local project or directory to review.
Claude
Codex