vipulawl

Vibe Audit — Security skill for Claude Code

Security community

Security scanner for AI-built apps.

How to install Vibe Audit

This entry records only its repository, not the path inside it, so there is no exact command to give. Open vipulawl/vibe-audit and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Vibe Audit does

Security scanner for AI-built apps. Catches hardcoded secrets, injection vulnerabilities, missing rate limits, and more — generates a scored HTML report with one-click fix prompts for Cursor/Claude/Copilot.

Alternatives in Security

MCP Security Checklist (SlowMist) — Comprehensive checklist: input validation, rate limiting, RBAC, credential management, container hardening 819 ★
ThinkWatch — Self-hosted AI API and MCP gateway for organizations: SSO and RBAC, per-user identity for MCP tool calls, PII 817 ★
Data Viz Audit — Audit a data visualization for chart type selection, accessible color palette, annotations, and anti-patterns 309 ★

README

vibe-audit

**Security scanner for AI-built apps.** Catches hardcoded secrets, injection vulnerabilities, missing rate limits, exposed API keys, and more — then generates a scored HTML dashboard with one-click fix prompts for your coding agent.

[![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/) [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE) [![GitHub stars](https://img.shields.io/github/stars/vipulawl/vibe-audit?style=social)](https://github.com/vipulawl/vibe-audit/stargazers)

The problem

Vibe coders ship fast. Security gets skipped. Then:

An API key in GitHub gets scraped by bots within minutes
No rate limiting means someone burns your $500 OpenAI credit overnight
A debug print(api_key) ends up in your server logs forever

vibe-audit runs in 30 seconds and tells you exactly what's wrong — in plain English, with fix prompts you can paste directly into Claude, Cursor, or Copilot.

Demo

$ vibe-audit ./my-app

vibe-audit scanning /Users/you/my-app

✓ Secrets: 1 issue
✓ .env Leaks: clean
✓ Frontend Exposure: clean
✓ Injection (SQL/XSS/CMD): 3 issues
✓ Sensitive Logging: 2 issues
✓ Security Headers: 1 issue
✓ Rate Limiting: 1 issue
✓ Dependencies: clean
✓ Auth Issues: clean

Score: 34/100 (Grade F)
Issues: 8 total

  Severity   Category          Title                              File
 ──────────────────────────────────────────────────────────────────────
  CRITICAL   Secrets           OpenAI API Key (v2) detected       config.py:12
  HIGH       Sensitive Log     Sensitive value in log statement   main.py:304
  HIGH       Rate Limiting     No rate limiting detected          .
  ...

✓ Report saved to security-report.html
  Open it in your browser for the full dashboard with fix prompts.

Then open `security-report.html`:

![Dashboard showing score 34/100 with red/yellow/green category cards and expandable findings with copy-paste fix prompts](https://