open skills / Claude Code + Codex

The checks worth keeping, ready to invoke.

One canonical SKILL.md, installed into both agents. Small enough to inspect, detailed enough to run, and open source all the way down.

Installs the selected skill globally for Claude Code and Codex. Review the source before giving any skill access to your code.

01 / securityopen standard

vibe-security-check

The feature works. Did the guard around it ship too?

A defensive, read-only-by-default audit for rapidly built web and SaaS apps. It traces auth, tenant isolation, data rules, storage, paid endpoints, URL fetchers, payments, uploads, and AI tools from untrusted input to side effect—then reports only evidence-backed findings.

Claude CodeCodex16 audit areassafe local tests

read SKILL.md ↗full checklist ↗

launch-blocker pass10 checks

01cross-user access
02open data rules
03client-side authority
04runaway spend
05broken tokens
06leaky RLS policies
07public storage
08pre-auth abuse
09server-side URL fetches
10AI tool injection

Then it widens to secrets, sessions, input handling, webhooks, uploads, supply chain, logging, and production configuration.

what the skill does

Evidence first. Exploit-shaped tests, safely contained.

Map the surface

Finds the actual clients, routes, roles, policies, storage, paid services, and trust boundaries in your repository.

Trace the guard

Follows sensitive actions end to end instead of declaring a grep hit a vulnerability or a missing hit a pass.

Show the work

Returns prioritized findings, file-level evidence, coverage, remediation, and the regression test that proves the fix.

invoke it

Same workflow. Native syntax in each agent.

Claude Code/vibe-security-check Audit this app before launch.

Codex$vibe-security-check Audit this app before launch.

Inspired by two practical r/SaaS field reports—part 1 and part 2—then corrected and expanded against OWASP and the relevant platform guidance. It is a focused review, not a penetration test or compliance certification.