skills.rest
Aradotso
AradotsoOFFICIAL
Explore all skills by this author →
Website𝕏@aradotsoGitHub

vibe-security-skill

Detect security vulnerabilities in AI-generated code across Supabase, Stripe, and auth flows.

11|1|Updated May 16, 2026
Search Tags:#code review#authentication#security audit#vulnerability detection#secrets scanning#supabase rls#stripe payments
One-click install
npx skills add https://github.com/Aradotso/security-skills --skill vibe-security-skill-aradotso
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vibe-security-skill
Source: https://github.com/Aradotso/security-skills/tree/main/skills/vibe-security-skill
Command: npx skills add https://github.com/Aradotso/security-skills --skill vibe-security-skill-aradotso

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps developers find common security vulnerabilities that AI coding assistants accidentally introduce into real applications, such as exposed secrets, broken authorization, and unsafe payment handling.

Core Features & Use Cases

  • Secrets & environment variable checks: Detects hardcoded API keys and secrets, and flags client-bundled secrets that should remain server-side.
  • Supabase RLS auditing: Verifies Row-Level Security is enabled and that policies correctly enforce per-user access.
  • Authn/authz and payment security review: Looks for insecure JWT usage, missing protection on API routes, and patterns where clients can influence pricing or other sensitive payment parameters.
  • Use case: You’re reviewing a new app generated with an AI coding assistant and want fast, targeted feedback focused on authentication, database access (Supabase), and payment flows (Stripe).

Quick Start

Ask the skill to audit your repository for security issues by saying: check this app for vulnerabilities.

Frequently Asked Questions about vibe-security-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my Supabase RLS policies for security vulnerabilities?▼

Scan your codebase using technology-aware reference rules to verify Supabase Row-Level Security is enabled and that policies correctly enforce per-user data access. This audit finds broken authorization in AI-generated applications.

How do I check my codebase for hardcoded secrets and exposed API keys?▼

Run a secrets scanning audit to detect hardcoded API keys and flags client-bundled secrets that should remain server-side. This identifies exposed environment variables accidentally introduced by AI coding assistants.

Does this security audit check for insecure Stripe payment logic?▼

Yes, the security audit checks Stripe payment logic for patterns where clients can influence pricing or other sensitive payment parameters. It looks for missing route protection and unsafe client-server trust boundaries.

What is the best way to review an AI-generated app for authentication vulnerabilities?▼

The best way to review an AI-generated app for authentication vulnerabilities is scanning for insecure JWT usage and missing API route protection. This targets insecure auth patterns typical of vibe-coded applications.

Can I use this to audit code generated by any AI coding assistant?▼

Yes, you can audit code generated by any AI coding assistant. It detects and explains security vulnerabilities introduced across typical web and mobile stacks, including exposed secrets, broken authorization, and unsafe payment handling.

Related Skills

Explore More Software Engineering Skills→
kenhiakenhia

atv-security

Automate security audits for GitHub projects by scanning source code for vulnerabilities.

Community
Advanced
Dhruvipatel0514Dhruvipatel0514
1

code-auditor

Identify and fix OWASP security vulnerabilities in source code repositories.

Community
Intermediate
Kushal9889Kushal9889

husky

Sets up Husky git hooks to automate code quality checks and testing before commits.

Community
Intermediate
dy9759dy9759
1

security-audit-expert

Identify and remediate security vulnerabilities across IT infrastructure and applications.

Community
Advanced