NoaGalerClaude Code
curl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \
| bash -s -- --group security \
--agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7Security
Package · 3 skillsAvailableAI application security reviews and local access-control regression tests.
Two security skills for your agent. security-agent-guard reviews code that uses an AI model, such as a chatbot, an agent, a tool integration or a RAG pipeline, for risks that exist because your app uses a model. It reports each finding with where it is, why it matters, how serious and how certain it is, and how to fix it, and does not change your code. security-access-regression turns your app's access rules into local tests that prove who can read or change whose records.
SecurityAI / Agents
- Claude Code
- Codex CLI
- GitHub Copilot
- Cursor
- Gemini CLI
Maintained by
The problem
An app that uses a language model has risks that ordinary code reviews do not look for. The model reads untrusted text, can call tools and see data, and other code trusts what it produces. General security reviews and secret scanning do not cover these risks. Access rules have a similar gap: an endpoint that returns nothing, or rejects everyone, can look safe until a test checks that the right user still gets in and the wrong one does not.
Skills in Security
Security has 3 skills. Open one to see when to use it and how to install it on its own.
Security access regression
security-access-regressionTurns an application's access rules into local regression tests that prove who can read or change whose records.Turns an application's access rules into local regression tests that prove who can read or change whose records. Use when adding tenant isolation, owner-only endpoints, private downloads, role permissions, or tests for a cross-user data leak. Not for general security review, login implementation, frontend/backend contract comparison, or testing a live service.
When to use
- Add regression coverage for an owner-only or tenant-scoped operation.
- Verify that a permission fix blocks the wrong user without breaking the right user.
- Test role changes, private downloads, or background operations that enforce the same access rule.
For a read-only review, use
pre-commit-security-reviewif installed. Usesecurity-agent-guardfor AI-specific risks. This skill writes focused permission tests, not a general audit or an API-shape comparison.Examples
User: "Add tests so one team's members cannot download another team's invoices."
Agent: Reads the download policy and test setup, creates two teams with synthetic invoices, proves the allowed download contains its fixture marker, and proves the other team's session receives the contract's denial without private bytes or a usable download URL. Records whether storage and redirect behavior were exercised.
User: "I fixed the owner check, but the list still returns 200. Test whether it's actually private."
Agent: Seeds distinguishable Alice and Bob records, checks that Alice's list contains Alice's marker and excludes Bob's, and adds the equivalent item-read test. A disposable-copy mutation that drops the owner filter must make the list test fail. Does not change the expected status to 403 merely to match a security checklist.
User: "Run this against our production API."
Agent: Does not send requests. Explains the local-only boundary and prepares an isolated fixture-based version instead.
View SKILL.mdInstall only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Security, install the whole package instead.
Terminalcurl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill security-access-regression \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7Security agent guard
security-agent-guardReviews code that uses LLMs or AI agents for AI-specific security risks - prompt injection, excessive agent permissions, unsafe tool calls, cross-user data leaks in retrieval (RAG), secrets or personal data in prompts, and unsafe use of model output.Reviews code that uses LLMs or AI agents for AI-specific security risks - prompt injection, excessive agent permissions, unsafe tool calls, cross-user data leaks in retrieval (RAG), secrets or personal data in prompts, and unsafe use of model output. Reports evidence-based findings with file and line, severity, certainty, and a fix. Use when the user asks to review the security of an AI feature, chatbot, agent, tool integration, or RAG pipeline. Not for general code security or committed secrets.
When to use
- The user asks whether an AI feature, chatbot, agent, or RAG pipeline is secure.
- The user asks for a security review of code that calls a model API, defines tools for a model, or builds prompts.
- The user asks about prompt injection, agent permissions, or data leaks through an AI feature.
Do not use this skill:
- to review code that does not use a model. Use
pre-commit-security-reviewif it is installed. - to find secrets committed to the repository. Use
secret-guardif it is installed. - to build or change an AI feature. This skill only reviews.
Examples
User: "Is my support chatbot secure? The code is in
support/."Agent: Finds the model call and its tools in
support/, maps sources (customer messages, order records), capabilities (lookup_order,issue_refund), and sinks (the reply shown in the staff dashboard). Loads the prompt injection, excessive agency, tool calling, and output handling references. Reports thatissue_refundruns without confirmation for any amount the model provides (high, confirmed), and that replies are inserted withinnerHTMLin the dashboard (high, confirmed). Lists RAG as not applicable.User: "Review my changes before I commit."
Agent: Reads the diff. The changes touch only CSS and a date helper, with no model calls. Says that this skill does not apply and suggests a general security review instead.
View SKILL.mdInstall only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Security, install the whole package instead.
Terminalcurl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill security-agent-guard \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7Security otp failopen
security-otp-failopenWrites local tests that prove a one-time code (SMS, email or authenticator) cannot be replayed, guessed, reused across accounts or purposes, and cannot fail open when the delivery provider errors or times out.Writes local tests that prove a one-time code (SMS, email or authenticator) cannot be replayed, guessed, reused across accounts or purposes, and cannot fail open when the delivery provider errors or times out. Use when adding or changing code verification, password reset by code, or step-up confirmation. Not for access-control matrices, general diff review, login implementation, or testing a live service.
When to use
- Add regression coverage for a code-based login, password reset, phone or email change, or step-up confirmation.
- Verify a change to code generation, storage, expiry or the provider adapter.
- Prove that an outage, timeout, or missing provider response blocks the flow instead of completing it.
For a read-only review of a diff, use
pre-commit-security-reviewif installed. Usesecurity-access-regressionwhen the question is who may read or change whose records. Usesecurity-agent-guardfor AI-specific risks. This skill writes tests for one verification flow, not a general audit.Examples
User: "We just added an SMS code to the password reset. Test it."
Agent: Reads the issue and verify handlers plus the SMS adapter, fills the matrix for that flow, then proves: correct code resets once; the same code fails on replay; an expired code fails; another account's code fails; a reset code cannot confirm a login. Uses a fake adapter, so no message leaves the machine.
User: "Our provider had an outage last week. Make sure that can't log anyone in."
Agent: Makes the fake adapter raise, time out, and return a
5xx, then asserts the flow ends unauthenticated in each case. Adds the single mutation that returns success from the error handler and confirms the test catches it.User: "Test our new SIM-swap step too, against the carrier."
Agent: Keeps the work local. Tests how the application treats each possible carrier answer, including unavailable and unsupported, using recorded shapes. Does not call a live carrier, and states that real-provider behaviour was not observed.
View SKILL.mdInstall only this skill
Command for Claude Code. To change the agent, use the picker in the installation section. To get every skill in Security, install the whole package instead.
Terminalcurl -fsSL https://raw.githubusercontent.com/vibe-md/vibe.md/7cb0620fbd80f9829155d8866328b58cd18d5aa7/scripts/install.sh \ | bash -s -- --skill security-otp-failopen \ --agent claude-code --ref 7cb0620fbd80f9829155d8866328b58cd18d5aa7
Install the whole package
Installs every skill in Security. To install a single skill, open it above and copy its own command.
One command
Install directly into your project.
Open Terminal in your project folder, then run this command. No ZIP, moving files, or prompt needed.
- 1Open your project folder in Terminal
- 2Run the command above
- 3Reload your agent and ask to use Security
Works on macOS, Linux, and Windows through WSL or Git Bash. The installer checks destinations and stops if existing files conflict.
What it does
Finds the AI parts first
Looks for model calls, prompt templates, tool definitions, agent frameworks, MCP servers and vector stores. If there are none, it says the review does not apply and stops.
Maps where text goes
For each AI feature, it notes where text enters the prompt and which of it is untrusted, which tools and data the model can reach, and where its output ends up.
Covers AI-specific risks
Prompt injection, excessive agent permissions, unsafe tool calls, cross-user data leaks in retrieval (RAG), secrets or personal data in prompts, and unsafe use of model output.
Findings backed by the code
Each finding gives the file and line for every part of the path, the risk, a concrete misuse, a severity of high, medium or low, whether it is confirmed or suspected, and a fix.
Says what it checked
The report ends with which AI features and risk areas were checked or skipped, and lists issues it noticed that belong to other reviews.
Tests who can see what
security-access-regression writes local tests that first prove the owner gets their data, then prove another user, team or role is denied through the same route, checking the data and side effects, not only the status code.
Usage examples
Type these to your agent in plain language. Here's what to expect.
you › Is my support chatbot secure? The code is in support/.
Expected workflow
- 01Finds the model call and its tools in the support folder.
- 02Maps where text comes from (customer messages, order records), which tools the model can use (lookup_order, issue_refund), and where replies are shown.
- 03Reports that issue_refund runs without confirmation for any amount the model gives, as high and confirmed.
- 04Reports that replies are inserted into the staff dashboard with innerHTML, as high and confirmed.
- 05Lists RAG as not applicable.
you › Review my changes before I commit.
Expected workflow
- 01Reads your changes.
- 02Finds only CSS and a date helper, with no model calls.
- 03Says this review does not apply and suggests a general security review instead.
you › Add tests so one team's members cannot download another team's invoices.
Expected workflow
- 01Reads the download rule and the test setup.
- 02Creates two teams with made-up invoices.
- 03Proves the allowed download contains its own invoice.
- 04Proves the other team is denied, with no private file contents or usable download link.
How it works
The skill works in a fixed order: set the scope, find the model calls, map each AI feature, then trace each path from where text comes in to where it ends up. If you do not name what to review, it looks at your current changes.
It loads only the checklists that fit what it found, such as prompt injection, tool calling or RAG security, and reports only problems it can point to in the code. Generic advice, and missing best practices with no path to harm, are left out.
security-access-regression picks one access rule at a time and checks that the tests run in an isolated environment with made-up users and data. To show the tests can actually fail, it removes the permission check in a disposable copy of your project, never in your own files, and confirms the tests catch it.
Safety and limitations
Required permissions
- Read your source code.
- Run git status and git diff, when available, to find your changes.
- security-access-regression: add test files and fixtures, and run your project's tests in an isolated local environment.
Limitations
- security-agent-guard never edits, deletes or commits anything, and never runs your project's code. It changes code only if you ask, one finding at a time.
- security-agent-guard only reviews code that uses an AI model. For general code security use Pre-commit Security Review, and for committed secrets use Secret Guard.
- A clean result only covers the AI features and risk areas it checked.
- security-access-regression writes tests, not a general security audit. It does not change your app's permission rules or fix production code unless you ask separately, never tests against a live service or real accounts, and does not stage, commit or push.
- Passing access tests do not prove the whole app is secure.
- It does not print secret values in its report.