skills.rest
thienty1207
thienty1207COMMUNITY
Explore all skills by this author →
GitHub

vibe-security-scan

Scan codebases for defensive security vulnerabilities using canonical rules and data-flow analysis.

1|Updated Sep 10, 2026
Search Tags:#code review#sql injection#owasp#security scan#vulnerability detection#appsec#data-flow analysis
One-click install
npx skills add https://github.com/thienty1207/Hotel_Staff --skill vibe-security-scan-thienty1207
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vibe-security-scan
Source: https://github.com/thienty1207/Hotel_Staff/tree/main/.baron/core/skills/vibe-security-scan
Command: npx skills add https://github.com/thienty1207/Hotel_Staff --skill vibe-security-scan-thienty1207

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? AI-assisted codebases often ship with classic vulnerabilities like SQL injection, hardcoded secrets, IDOR, and missing rate limits. This Skill provides a structured defensive security review that confirms findings with source-to-sink evidence instead of noisy keyword matching. ## Core Features & Use Cases - Canonical Rule Set: Checks code against 21 canonical rules covering secrets, SQL injection, XSS, IDOR, CSRF, SSRF, mass assignment, command injection, and more, each with a maximum severity cap. - Language Overlays: Detects the primary language and loads specialized rules for TypeScript/JavaScript, Python, PHP, Go, and Rust, with generic rules as fallback. - Bounded Scan Modes: Supports focused scans for narrow changes, full audits for production readiness, and sequential chunked reviews for large repositories without creating workspace files. - Use Case: Before deploying a new authentication and payment flow, run a full scan to confirm password hashing, rate limits, idempotency, and tenant isolation, then receive a Vietnamese or English report with severity counts, evidence, and safe fixes. ## Quick Start Ask the assistant to run a defensive security scan on the current repository and report confirmed vulnerabilities with severity, evidence, and recommended fixes.

Frequently Asked Questions about vibe-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for security vulnerabilities before deployment?▼

Run a full scan mode, which loads all 21 generic rules plus the overlay for your detected language. The scan maps trust boundaries, searches for leads, confirms each finding with source-to-sink evidence, and outputs a report with severity counts, fixes, and verification steps.

What security issues does a vibe coding security scan detect?▼

It detects 21 canonical issue types including hardcoded secrets, SQL injection, XSS, IDOR, slopsquatting, brute-force exposure, mass assignment, insecure deserialization, SSRF, path traversal, CSRF, broken access control, weak password hashing, JWT none algorithm, CORS misconfiguration, unrestricted uploads, verbose errors, missing rate limits, race conditions, outdated dependencies, and command injection.

Does the security scan support Go, Python, and TypeScript projects?▼

Yes, it ships language overlays for TypeScript/JavaScript, Python, PHP, Go, and Rust. Language detection counts code files by extension, applies overlays for any language above 30 percent, and falls back to generic rules for polyglot repositories.

How does the scan avoid false positives from pattern matching?▼

It treats grep matches as leads only, then applies L1-L4 data-flow classification to trace whether user-controlled input actually reaches a dangerous sink without sanitization. Findings require confirmed source-to-sink evidence, and uncertain cases are downgraded with a note.

Can the scan handle large repositories?▼

Yes, the large-review workflow partitions the file list into bounded in-memory chunks processed sequentially, then aggregates and deduplicates findings by file, line, and rule ID. It creates no temporary directories or report files unless the user explicitly requests a saved artifact.

When should I not use this security scan skill?▼

Skip it for purely visual UI work, copy changes, local-only refactors, or test-only edits that do not touch a security-sensitive boundary. It is a defensive review playbook and does not replace a professional security audit or the final independent security-auditor gate.

Related Skills

Explore More Software Engineering Skills→
openaiopenai
5.3k

define-security-policy

Define and update SECURITY.md guidance for repository security scanning.

Official
Advanced
SynkraAISynkraAI
3.1k

aiox-apply-qa-fixes

Applies QA gate findings to a story and hands back for re-review.

Official
Intermediate
Ed1s0nZEd1s0nZ
6.2k

source-code-hunting

Hunt source code leaks, hardcoded secrets, and supply-chain risks using grep, semgrep, and trufflehog.

Community
Intermediate
RifteoRifteo
30

scope-grill

Build a structured penetration testing engagement brief with scope and rules of engagement.

Official
Advanced