AI代码安全审计工具 - 检测vibe-coding应用漏洞，防止数据泄露与API密钥被盗

vibe-security by raroque/vibe-security-skill

629 周安装量

343 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/raroque/vibe-security-skill --skill vibe-security

AI/机器学习开发安全

🇨🇳中文介绍

审计代码中由 AI 代码生成常见引入的安全漏洞。这些问题在"氛围编码"应用中普遍存在——即借助 AI 快速构建但跳过了安全基础的项目。

AI 助手在处理这些模式时经常出错，导致实际的数据泄露、API 密钥被盗和账单账户被清空。本技能旨在在问题发布前发现这些错误。

核心原则

永远不要信任客户端。每一个价格、用户 ID、角色、订阅状态、功能开关和速率限制计数器都必须在服务端进行验证或强制执行。如果它只存在于浏览器、移动应用包或请求体中，那么攻击者就能控制它。

审计流程

系统地检查代码库。对于每个步骤，仅在代码库使用相关技术或模式时加载对应的参考文件。跳过不相关的步骤。

密钥与环境变量 — 扫描硬编码的 API 密钥、令牌或凭据。检查通过客户端环境变量前缀（NEXT_PUBLIC_、VITE_、EXPO_PUBLIC_）暴露的密钥。验证 .env 是否在 .gitignore 中。参见 references/secrets-and-env.md。
数据库访问控制 — 检查 Supabase RLS 策略、Firebase 安全规则或 Convex 身份验证守卫。这是氛围编码应用中关键漏洞的首要来源。参见 references/database-security.md。

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

相关 Skills

find-skills 技能搜索工具 - Vercel Labs 开源智能体技能包管理器

776,000 周安装

Vercel React 最佳实践指南 | 58条Next.js性能优化规则与代码重构

261,300 周安装

Vercel Web界面规范检查工具 - 自动检测代码是否符合Web设计指南

210,800 周安装

agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试

140,500 周安装

身份验证与授权 — 验证 JWT 处理、中间件身份验证、Server Action 保护和会话管理。参见 references/authentication.md。

速率限制与滥用防护 — 确保身份验证端点、AI 调用和昂贵操作有速率限制。验证速率限制计数器不能被篡改。参见 references/rate-limiting.md。

支付安全 — 检查客户端价格操纵、Webhook 签名验证和订阅状态验证。参见 references/payments.md。

移动端安全 — 验证安全令牌存储、通过后端代理保护 API 密钥以及深度链接验证。参见 references/mobile.md。

AI / LLM 集成 — 检查暴露的 AI API 密钥、缺失的使用上限、提示注入向量和不安全的输出渲染。参见 references/ai-integration.md。

部署配置 — 验证生产环境设置、安全标头、源代码映射暴露和环境隔离。参见 references/deployment.md。

数据访问与输入验证 — 检查 SQL 注入、ORM 误用和缺失的输入验证。参见 references/data-access.md。

如果进行部分审查或在特定领域生成代码，仅加载相关的参考文件。

仅报告真正的安全问题。不要吹毛求疵地评论样式或非安全问题。
当存在多个问题时，按可利用性和实际影响确定优先级。
如果代码库未使用特定技术（例如，没有使用 Supabase），则完全跳过该部分。
生成新代码时，主动查阅相关参考文件，从一开始就避免引入漏洞。
如果发现关键问题（暴露的密钥、禁用的 RLS、身份验证绕过），请立即在响应顶部标记它——不要将其埋没在长列表中。

按严重程度组织发现的问题：严重 → 高 → 中 → 低。

对于每个问题：

说明文件和相关的行号。
命名漏洞。
解释攻击者可以做什么（具体影响，而非抽象风险）。
展示修复前后的代码。

跳过没有问题的区域。最后给出一个优先级总结。

lib/supabase.ts:3 — Supabase service_role 密钥暴露在客户端包中

service_role 密钥会绕过所有行级安全策略。任何人都可以从浏览器包中提取它，并读取、修改或删除数据库中的每一行数据。

// 修复前
const supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_SERVICE_KEY!)

// 修复后 — 在客户端使用匿名密钥；service_role 应仅用于服务端代码
const supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!)

app/api/checkout/route.ts:15 — 价格取自客户端请求体

攻击者可以通过修改请求来设定任意价格（包括 0.01 美元）。价格必须在服务端查询。

// 修复前
const session = await stripe.checkout.sessions.create({
  line_items: [{ price_data: { unit_amount: req.body.price } }]
})

// 修复后 — 在服务端查询价格
const product = await db.products.findUnique({ where: { id: req.body.productId } })
const session = await stripe.checkout.sessions.create({
  line_items: [{ price: product.stripePriceId }]
})

服务角色密钥暴露（严重）： 任何人都可以绕过所有数据库安全措施。立即轮换密钥并仅将其用于服务端。
客户端控制定价（高）： 攻击者可以以任意价格购买。使用服务端价格查询。

这些规则也适用于主动预防。在编写涉及身份验证、支付、数据库访问、API 密钥或用户数据的代码之前，请查阅相关参考文件，从一开始就避免引入漏洞。预防胜于检测。

references/secrets-and-env.md — API 密钥、令牌、环境变量配置和 .gitignore 规则。
references/database-security.md — Supabase RLS、Firebase 安全规则和 Convex 身份验证模式。
references/authentication.md — JWT 验证、中间件、Server Actions 和会话管理。
references/rate-limiting.md — 速率限制策略和滥用防护。
references/payments.md — Stripe 安全、Webhook 验证和价格验证。
references/mobile.md — React Native 和 Expo 安全：安全存储、API 代理、深度链接。
references/ai-integration.md — LLM API 密钥保护、使用上限、提示注入和输出清理。
references/deployment.md — 生产环境配置、安全标头和环境隔离。
references/data-access.md — SQL 注入预防、ORM 安全性和输入验证。

🇺🇸English

Audit code for security vulnerabilities commonly introduced by AI code generation. These issues are prevalent in "vibe-coded" apps — projects built rapidly with AI assistance where security fundamentals get skipped.

AI assistants consistently get these patterns wrong, leading to real breaches, stolen API keys, and drained billing accounts. This skill exists to catch those mistakes before they ship.

The Core Principle

Never trust the client. Every price, user ID, role, subscription status, feature flag, and rate limit counter must be validated or enforced server-side. If it exists only in the browser, mobile bundle, or request body, an attacker controls it.

Audit Process

Examine the codebase systematically. For each step, load the relevant reference file only if the codebase uses that technology or pattern. Skip steps that aren't relevant.

Secrets & Environment Variables — Scan for hardcoded API keys, tokens, or credentials. Check for secrets exposed via client-side env var prefixes (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_). Verify .env is in .gitignore. See references/secrets-and-env.md.
Database Access Control — Check Supabase RLS policies, Firebase Security Rules, or Convex auth guards. This is the #1 source of critical vulnerabilities in vibe-coded apps. See references/database-security.md.
Authentication & Authorization — Validate JWT handling, middleware auth, Server Action protection, and session management. See references/authentication.md.
Rate Limiting & Abuse Prevention — Ensure auth endpoints, AI calls, and expensive operations have rate limits. Verify rate limit counters can't be tampered with. See references/rate-limiting.md.
Payment Security — Check for client-side price manipulation, webhook signature verification, and subscription status validation. See references/payments.md.
Mobile Security — Verify secure token storage, API key protection via backend proxy, and deep link validation. See references/mobile.md.
AI / LLM Integration — Check for exposed AI API keys, missing usage caps, prompt injection vectors, and unsafe output rendering. See references/ai-integration.md.
Deployment Configuration — Verify production settings, security headers, source map exposure, and environment separation. See references/deployment.md.
Data Access & Input Validation — Check for SQL injection, ORM misuse, and missing input validation. See references/data-access.md.

If doing a partial review or generating code in a specific area, load only the relevant reference files.

Core Instructions

Report only genuine security issues. Do not nitpick style or non-security concerns.
When multiple issues exist, prioritize by exploitability and real-world impact.
If the codebase doesn't use a particular technology (e.g., no Supabase), skip that section entirely.
When generating new code, consult the relevant reference files proactively to avoid introducing vulnerabilities in the first place.
If you find a critical issue (exposed secrets, disabled RLS, auth bypass), flag it immediately at the top of your response — don't bury it in a long list.

Output Format

Organize findings by severity: Critical → High → Medium → Low.

For each issue:

State the file and relevant line(s).
Name the vulnerability.
Explain what an attacker could do (concrete impact, not abstract risk).
Show a before/after code fix.

Skip areas with no issues. End with a prioritized summary.

Example Output

Critical

lib/supabase.ts:3 — Supabase service_role key exposed in client bundle

The service_role key bypasses all Row-Level Security. Anyone can extract it from the browser bundle and read, modify, or delete every row in your database.

// Before
const supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_SERVICE_KEY!)

// After — use the anon key client-side; service_role belongs only in server-side code
const supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!)

High

app/api/checkout/route.ts:15 — Price taken from client request body

An attacker can set any price (including $0.01) by modifying the request. Prices must be looked up server-side.

// Before
const session = await stripe.checkout.sessions.create({
  line_items: [{ price_data: { unit_amount: req.body.price } }]
})

// After — look up the price server-side
const product = await db.products.findUnique({ where: { id: req.body.productId } })
const session = await stripe.checkout.sessions.create({
  line_items: [{ price: product.stripePriceId }]
})

Summary

Service role key exposed (Critical): Anyone can bypass all database security. Rotate the key immediately and move it to server-side only.
Client-controlled pricing (High): Attackers can purchase at any price. Use server-side price lookup.

When Generating Code

These rules also apply proactively. Before writing code that touches auth, payments, database access, API keys, or user data, consult the relevant reference file to avoid introducing the vulnerability in the first place. Prevention is better than detection.

References

references/secrets-and-env.md — API keys, tokens, environment variable configuration, and .gitignore rules.
references/database-security.md — Supabase RLS, Firebase Security Rules, and Convex auth patterns.
references/authentication.md — JWT verification, middleware, Server Actions, and session management.
references/rate-limiting.md — Rate limiting strategies and abuse prevention.
references/payments.md — Stripe security, webhook verification, and price validation.
references/mobile.md — React Native and Expo security: secure storage, API proxy, deep links.
references/ai-integration.md — LLM API key protection, usage caps, prompt injection, and output sanitization.

Weekly Installs

496

Repository

raroque/vibe-se…ty-skill

GitHub Stars

283

First Seen

10 days ago

Security Audits

Gen Agent Trust HubPass SocketPass SnykFail

Installed on

kimi-cli493

gemini-cli493

cursor493

github-copilot493

opencode493

amp493

React 组合模式指南：Vercel 组件架构最佳实践，提升代码可维护性

106,200 周安装

references/deployment.md — Production configuration, security headers, and environment separation.

references/data-access.md — SQL injection prevention, ORM safety, and input validation.