agentsclimarketplace
Sign in

Vibeguard

Skill edilkoke/vibeguard

Use when building, reviewing, or hardening a web application with AI assistance — especially "vibe-coded" apps on Next.js + Supabase. VibeGuard enforces secure-by-default code generation and reviews output against a catalogue of the 21 most common AI-coding vulnerabilities (exposed secrets, broken access control, injection, weak auth, missing privacy controls, vulnerable dependencies). Trigger on: "build an app", "add auth", "is this secure", "review my code", "harden", "deploy", or any handling of payments, identity, logins, or customer data.From its SKILL.md

Install
npx -y skills add edilkoke/vibeguard

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.0 KB, 328 tokens by cl100k_base, as published. Nobody here has run it

VibeGuard — secure-by-default for AI-built web apps

When to apply

Apply whenever generating or reviewing application code, configuration, or deployment settings — particularly anything touching authentication, payments, identity, location, customer data, secrets, third-party integrations, or database access.

How to use it

  1. Read governance.yaml at the project root (scaffold it from governance.example.yaml if missing). The declared data flags determine which rules are mandatory.
  2. Generate against the rules. Follow ai-context/CLAUDE.md — every applicable rule in rules/catalogue.yaml must be satisfied by construction (parameterized queries, server-side authz with ownership checks, env-managed secrets, HttpOnly cookies, etc.).
  3. Self-review before returning code. Walk the relevant rules/catalogue.yaml entries for the files you touched and confirm each detect condition is NOT present.
  4. Never hardcode secrets, ship secret keys to the client, weaken access control, or disable a security control to "make it work."

What it is NOT

Not a guarantee of security and not a substitute for professional testing. VibeGuard reduces common, high-impact flaws at generation time. Pair it with the CI gates and a human reviewer for anything that ships.

Knowledge base: rules/catalogue.yaml · Risk manifest: governance.schema.yaml · Coverage: docs/coverage-map.md

What ships with it: 49 files

71.0 KB alongside SKILL.md, 16 of them executable

ai-context/

ci/

docs/

evaluation/

launch/

rules/

templates/

9 more files not listed here. See all 49 in the repository.

Keep looking

Skills are one crate of 326,852. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.