Vibe-Code Security Gate by Venkai

    1

    Scans a deployed AI-built app (Lovable, Bolt, Replit, Cursor) for exposed secrets, open Supabase tables, and missing security headers — then returns a SHIP/FIX/BLOCK verdict.

    $29

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    Vibe-Code Security Gate by Venkai

    Example session with this skill installed

    /vibe-code-security-gate https://juice-shop.herokuapp.com --i-own-this

    (OWASP Juice Shop: the official public app intentionally built vulnerable for security testing — real output, nothing faked.)

    • Read your context and instructions
    • Compiled the vibe-code security gate

    Summary

    Real scan of the OWASP Juice Shop public demo (an app intentionally built vulnerable for security testing) — verdict

    FIX, 6 findings, no fabricated output.

    VERDICT: FIX  (6 constats)
[HIGH] ADMIN_OPEN: /admin responds 200 with no login required
    -> require a session + a server-side role check
[HIGH] ADMIN_OPEN: /debug responds 200 with no login required
    -> require a session + a server-side role check
[HIGH] ADMIN_OPEN: /dashboard/admin responds 200 with no login required
    -> require a session + a server-side role check
[HIGH] CORS_OPEN: CORS accepts an arbitrary origin
    -> allow-list specific origins
[MEDIUM] HEADER_MISSING: content-security-policy header missing
    -> add a CSP
[MEDIUM] HEADER_MISSING: strict-transport-security header missing
    -> add HSTS

    Next steps

    • Fix the HIGH findings first (exposed admin routes, open CORS), they're exploitable by anyone with a browser.
    • Add the missing headers (CSP, HSTS).
    • Run the code-review checklist (Step 2 of the skill) for IDOR and write-side RLS, which this black-box scan cannot see.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    AI-generated applications often prioritize functionality over security, leading to recurring vulnerabilities like exposed environment variables or misconfigured database permissions. This skill identifies common security failures in "vibe-coded" stacks including Supabase, Stripe, and modern frontend frameworks before they reach production. It performs a dual-layer assessment: a black-box external scan to detect exposed secrets and misconfigured headers, followed by a targeted code review for logical flaws like IDOR vulnerabilities and missing server-side authorization.

    What it does

    • Secret Detection: Scans JavaScript bundles for leaked Stripe, OpenAI, Anthropic, or AWS keys and service-role credentials.
    • Supabase Audit: Checks for tables with Row Level Security (RLS) disabled or permissive policies allowing unauthorized updates.
    • Configuration Scan: Identifies exposed .env or .git directories and missing security headers like CSP and HSTS.
    • Logic Review: Analyzes API routes for IDOR risks and ensures webhook signatures are verified before processing.
    • Cost Protection: Flags missing rate limits on high-cost LLM endpoints and authentication routes.

    How it works

    1. Target Verification: Confirms ownership or permission to scan the target URL to ensure authorized testing only.
    2. External Scan: Runs a read-only black-box analysis on the deployed URL to find public-facing vulnerabilities.
    3. Internal Review: Audits the repository for specific authorization patterns, secret usage, and input handling.
    4. Verdict Generation: Issues a SHIP, FIX, or BLOCK status based on the severity of identified risks.

    Frameworks & tools

    This tool targets modern web stacks including Supabase, Stripe, Tailwind, and React/Next.js. It uses a specialized Python-based scanner for external audits and supports code analysis for apps built with Lovable, Bolt, Cursor, v0, and Claude Code.

    Why this beats prompting it yourself

    Generic prompts often miss the specific quirks of AI-generated code, such as service-role keys accidentally imported into client components. This skill follows a rigid, read-only protocol that provides exact SQL and code snippets for fixes rather than vague architectural advice.

    Use cases

    • Auditing a Supabase backend for RLS leaks before opening a public beta.
    • Checking for exposed API keys in high-velocity AI-generated frontend builds.
    • Verifying Stripe webhook signature logic before processing live payments.
    • Ensuring .env files and git history are not accessible on a production server.

    Known limitations

    Does not perform write-based testing, brute-force attacks, or load testing. Scans are read-only and cannot detect deep architectural flaws outside the specified focus areas.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 1 day ago

    • Passed all security checks, Safe to install

    Requires

    Git

    Listed1 day ago

    What's inside

    Frequently Asked Questions