VibeSec Skill

This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.

1,379 stars 122 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add BehiSecc/VibeSec-Skill --skill VibeSec-Skill

Manual install

git clone --depth 1 https://github.com/BehiSecc/VibeSec-Skill.git /tmp/VibeSec-Skill
mkdir -p ~/.claude/skills
cp -r /tmp/VibeSec-Skill/. ~/.claude/skills/VibeSec-Skill

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Secure Coding Guide for Web Applications

## Overview

This guide provides comprehensive secure coding practices for web applications. As an AI assistant, your role is to approach code from a **bug hunter's perspective** and make applications **as secure as possible** without breaking functionality.

**Key Principles:**
- Defense in depth: Never rely on a single security control
- Fail securely: When something fails, fail closed (deny access)
- Least privilege: Grant minimum permissions necessary
- Input validation: Never trust user input, validate everything server-side
- Output encoding: Encode data appropriately for the context it's rendered in

---

## Access Control Issues

Access control vulnerabilities occur when users can access resources or perform actions beyond their intended permissions.

### Core Requirements

For **every data point and action** that requires authentication:

1. **User-Level Authorization**
   - Each user must only access/modify their own data
   - No user should access data from other users or organizations
   - Always verify ownership at the data layer, not just the route level

2. **Use UUIDs Instead of Sequential IDs**
   - Use UUIDv4 or similar non-guessable identifiers
   - Exception: Only use sequential IDs if explicitly requested by user

3. **Account Lifecycle Handling**
   - When a user is removed from an organization: immediately revoke all access tokens and sessions

Read the full skill on GitHub

Details

Skill name: VibeSec-Skill
Repository: BehiSecc/VibeSec-Skill
License: Apache-2.0
Repo updated: 17 February 2026
Listed in: BehiSecc/awesome-claude-skills, VoltAgent/awesome-agent-skills

FAQ

What does the VibeSec Skill skill do?

This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.

How do I install the VibeSec Skill skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add BehiSecc/VibeSec-Skill --skill VibeSec-Skill. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is VibeSec Skill popular?

It lives in BehiSecc/VibeSec-Skill, which has 1,379 GitHub stars and 122 forks, and is included in 2 curated skill lists.

Related skills

Find Bugs

1.1k

getsentry/skills

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

SecurityIn 1 list62

Tirith

2.8k

sheeki03/tirith

Terminal security analysis for shell environments. This skill should be used when checking commands for supply-chain attacks before execution, scanning repositories for hidden content or config poisoning, scoring URLs for homograph attacks, setting up AI tool protection, inspecting Python package artifacts, governing untrusted tasks or Web3 commands, auditing browser extensions, creating provenance receipts, downloading and executing scripts safely, investigating why tirith blocked a command, managing trusted patterns, running security audits, configuring MCP gateway proxies, or working with t

Security104

Security Guide

139

jnMetaCode/shellward

OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation

SecurityIn 1 list23

Positioning Workshop

7.8k

deanpeters/Product-Manager-Skills

Run a positioning workshop that surfaces target customer, unmet need, category, benefits, and differentiation. Use when your product messaging feels fuzzy, generic, or misaligned.

SecurityIn 3 lists940

Claude Pentest Skills

frendysanusi/claude-pentest-skills

Structured web application penetration testing with OWASP methodology, curated payload references, 6-gate validation, and professional report generation

Security12

Bug Bounty

5.5k

awarexone/Agentic-Bug-Hunter

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via co

Security970

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.