1. Habit
  2. Skills
  3. Vibe Security skill
raroque · 4K installs

Vibe Security skill
Runs by itself, code changes.

Common AI-coded security holes caught.

Install the Vibe Security skill and make it a habit: follow https://gethabit.dev/skills/raroque/vibe-security.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

4K installs1K starsMIT licenceSource on GitHub ↗

Vibe Security

by raroque · 4K installs

The skill

Vibe Security audits codebases for the security holes AI assistants commonly introduce: exposed secrets, broken access control, missing auth, client-trust and payment flaws.

Only when you ask.

The habit

Common AI-coded security holes caught.

↻ Runs by itselfcode changes

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

code changes. Runs in GitHub Actions or Claude Code routine.

  • ↻ code changes
  • push or pull request

02

It checks its work

findings by severity. If a check fails, it tells you.

  • ✓secrets scan finds no hardcoded keys or client-exposed secret prefixes
  • ✓.env is in .gitignore
  • ✓database access rules exist where the stack uses them
  • ✓findings are ordered Critical to Low with file and line

03

It remembers

security findings log. The next run reads it first: prior findings and which areas were already clean.

loops/vibe-security-audit-loop/run-log.md

One run, step by step.
Then it stops.

Stop ruleStops after one audit per run, with at most one re-scan.

  1. 01

    Scan secrets

    Your agent scans for hardcoded keys, client-exposed secret prefixes and a missing .gitignore entry.

  2. 02

    Check database access

    It checks Supabase RLS, Firebase rules or Convex auth guards where the stack uses them.

  3. 03

    Check auth

    It validates token handling, middleware auth and server action protection.

  4. 04

    Check payments and limits

    It checks for client-side price trust, webhook signature checks and rate limits on costly operations.

  5. 05

    Report

    It orders findings Critical to Low with file and line, impact and a before-and-after fix.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the Vibe Security skill helps.

Use it when

  • ✓ auditing an AI-built app for security
  • ✓ checking secrets, auth or database rules
  • ✓ reviewing payment and access control flows

Skip it when

  • – you want a non-security code review
  • – the project handles no secrets, auth or user data

Questions

Vibe Security skill, answered.

What is the core rule?

Never trust the client. Every price, role and limit must be enforced server-side, or an attacker controls it.

Does it report style issues?

No. It reports only genuine security issues, prioritised by exploitability and real-world impact.

How do I install the Vibe Security skill?

Copy the prompt at the top into your agent. It installs the skill from raroque/vibe-security-skill and sets up the habit. Or run npx skills add raroque/vibe-security-skill --skill vibe-security.

Is the Vibe Security skill free?

Yes. It is published under MIT. Habit is free too.

Vibe Security. Now as a habit.

Install the Vibe Security skill and make it a habit: follow https://gethabit.dev/skills/raroque/vibe-security.md

  • Free
  • No account
  • Undo in one line

All raroque skills →More code skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by raroque, published under MIT. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.