Slopsec

Security audit and hardening for vibe-coded SaaS apps. Use when reviewing, securing, hardening, or pen-testing an app — especially AI-generated / vibe-coded / "shipped fast" projects (Next.js, Supabase, Firebase, Express, serverless). Triggers: "is my app secure", "security review", "harden this", "check for vulnerabilities", "I'm about to launch", "audit before deploy", "exposed secrets", "leaked API keys", "before I ship". Walks the 50 most common ways vibe-coded apps get owned and produces a prioritized fix list.

25 stars 2 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add lachydotmcg/slopsec --skill slopsec

Manual install

git clone --depth 1 https://github.com/lachydotmcg/slopsec.git /tmp/slopsec
mkdir -p ~/.claude/skills
cp -r /tmp/slopsec/. ~/.claude/skills/slopsec

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# slopsec

Security review built for **vibe-coded SaaS slop**: apps shipped fast with AI
assistance, where the gap between "it works" and "it's safe to expose to the
internet" is where attackers live. The premise of the source material is simple
— a freshly launched app got probed by an attacker within 3 hours. Bots scan
the whole IPv4 space constantly; "nobody knows my URL yet" is not a defense.

This skill turns 50 recurring failure modes into a repeatable audit. Use it to
**review** existing code or **harden** before a launch.

## How to use this skill

1. **Scope it.** Identify the stack (frontend framework, backend, database,
   auth provider, hosting) and where secrets live. Most slop vulns cluster
   around Supabase/Firebase rules, missing server-side authz, and leaked env.
2. **Run the audit.** Walk every item in `references/checklist.md`. For each,
   either confirm it's handled or flag it. Don't skip categories because the
   app "looks fine" — the dangerous bugs are invisible from the UI.
3. **Prove the findings.** Where safe and authorized, demonstrate the issue
   (e.g. fetch another user's row via the API, hit an admin route unauthed,
   grep the built JS bundle for secrets). A demonstrated bug gets fixed; a
   theoretical one gets argued about.
4. **Prioritize.** Score each finding by `references/severity.md`. Lead with
   the catastrophic, instantly-exploitable ones (exposed creds, missing authz,

Read the full skill on GitHub

Details

Skill name: slopsec
Repository: lachydotmcg/slopsec
License: MIT
Repo updated: 24 July 2026

FAQ

What does the Slopsec skill do?

How do I install the Slopsec skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add lachydotmcg/slopsec --skill slopsec. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Slopsec popular?

It lives in lachydotmcg/slopsec, which has 25 GitHub stars and 2 forks.

Related skills

Move Auditor

pantheraudits/move-auditor

Audits Move contracts (Sui & Aptos) for security bugs.

Security

Pentest Tool

Jumbo-WJB/pentest-skills

Autonomous penetration testing framework. Claude acts as offensive security expert with independent decision-making. Provides methodology and principles, not command scripts. ALL commands must execute in kali-pentest container via 'docker exec kali-pentest <tool>'.

Security

Security Research

rhysha/claude-security-research-skill

Full-spectrum security research skill for web servers, REST APIs, web applications, and network/port enumeration. Triggers whenever the user wants to: find vulnerabilities, run a security assessment, scan a target, test an API for security issues, enumerate ports or services, check for OWASP Top 10 vulnerabilities, audit auth/secrets, fuzz endpoints, run recon on a domain or IP, or use tools like nmap, nikto, nuclei, ZAP, sqlmap, ffuf, dalfox, subfinder, hydra, or trufflehog. Use this skill even if the user says "just a quick scan" or phrases it casually. Covers full engagement workflow: recon

Security

Prism Scanner

aidongise-cell/prism-scanner

Security scanner for AI Agent skills, plugins, and MCP servers. Use when: user asks to scan a skill, check if a plugin is safe, vet an MCP server, review skill security, detect malicious code, supply chain safety, or says 'is this safe to install', 'scan this skill', 'check this MCP server', 'security scan', 'vetting', 'skill safety', 'prism scan', '安全扫描', '这个插件安全吗', '扫描一下', '检查安全性', '安装前检查', '技能审查'.

Security

Security Scan

Ray0907/security-scan

Use when a user asks to scan a repository for dependency vulnerabilities, license compliance, insecure code patterns, CVEs, or OWASP Top 10 risks.

Security

R00 BehiSecc Awesome Claude Skills Security

freewaychameleonnode/r17-behisecc-awesome-claude-skills-security

🔒 Security & Compliance skill suite derived from BehiSecc/awesome-claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.