Reviews staged, changed, and new files for security vulnerabilities such as injection, unsafe deserialization, missing validation, broken access control, and sensitive data in logs, then explains each finding and how to fix it. Use before committing or pushing, or when the user asks whether their changes are safe.
Before you commit or push, this skill has your agent review your changes for security problems such as injection, broken access control and sensitive data in logs. For each problem, it explains where it is, how it could be exploited, how serious it is and how to fix it, so you understand the fix and don't just apply it.
When code handles user input, queries a database, runs commands, reads files or checks who is logged in, one unchecked value can let an attacker in. These problems are easy to miss in a change that works. A fix you don't understand is easy to get wrong.
Reviews only what changed
Reads your staged changes, or your unstaged changes if nothing is staged, plus new files and the code they directly call. It does not audit the whole repository. On a large change it starts with the riskiest files and tells you which files it did not reach.
Follows untrusted input
Traces data from where it enters, such as request parameters, uploads and responses from other services, to where it is used. Then it checks a list of common problems, including injection, path traversal, cross-site scripting, missing access checks, weak validation, weak cryptography and secrets or personal data in logs.
Explains every finding the same way
Each finding has the file and line, the problem in one sentence, a concrete attack, a severity of high, medium or low, and a fix with the reason it is better than the alternatives.
Confirmed or suspected
Marks a finding as confirmed when the exploit path is visible in the code, or suspected when it depends on code it could not see. A suspicion is never presented as fact.
Ends with a verdict
Tells you whether it is safe to commit, safe after fixing the high items, or not safe to commit. If nothing was found, it says what was checked.
One command
Open Terminal in your project folder, then run this command. No ZIP, moving files, or prompt needed.
Yossi4curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \
| bash -s -- --skill pre-commit-security-review \
--agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7Works on macOS, Linux, and Windows through WSL or Git Bash. The installer checks destinations and stops if existing files conflict.
Type these to your agent in plain language. Here's what to expect.
you › Check my staged changes before I push.
Expected workflow
you › Is this logging OK?
Expected workflow
The skill starts from what you are about to commit: git status, then the staged diff. Tracing where untrusted input goes is the core of the review. The checklist comes after it, and problem types that don't apply to your stack are skipped.
It does not assume a language or framework, and works out your stack from the project. It presents its findings first and lets you decide what to fix.