Open-Sourced Claude Code Security Audit Skill
kemalios · reddit · 2026-07-13
Working in web development and SEO, the author frequently inherits projects built by clients using AI tools like Lovable, Bolt, and Cursor, asking them to "make it real." They noticed a common fatal flaw across these projects: they appear complete, but altering a single URL could potentially expose all user data without anyone noticing.
The most prevalent vulnerabilities include:
- Supabase tables lacking row-level security, allowing anonymous users to directly read and write all rows.
- The servicerole key being exposed in the frontend bundle via a VITE prefix, completely bypassing RLS.
The author points out that while AI coding tools excel at "getting things to run," they fail to distinguish between "permitted design" and "critical security vulnerabilities." To solve this, they converted their personal audit checklist into a Claude Code skill. It automatically identifies the project stack and evaluates five domains: frontend, backend/data, auth/security, infrastructure, and recovery/ops. It outputs a scorecard with file paths and a remediation list, iterating until the score turns from 0/5 to green.
They emphasize that the skill's value lies not in being "smarter," but in altering default behaviors: unverifiable items always require manual review, and simply taking the user's word that "it's fine" won't automatically trigger a green light. A fixed rubric ensures that scores remain comparable and trackable over time. The project is open-sourced under MIT and can be installed directly into Claude Code.
More from coding & agent
- Shopify design lead on AI-era workflow: designers are becoming full-stack editors — KlausCodes · 2026-10-26
- Drex for Search hits Nace API console, saving 397k tokens and 56.8% latency per query — testingcatalog · 2026-10-26
- Nace AI launches Drex for Search, cutting agent steps 62% and tokens 56% — testingcatalog · 2026-10-26
- Ultrametric open-sources Open Startup Repo to let AI agents run startup operations — garrytan · 2026-10-26
- MCP fault injection study: agent task scores drop 60% under realistic tool failures, scale doesn't help — dair_ai · 2026-10-26
- General agents burn ~140M tokens/month on LinkedIn outreach; scripts do it 60x cheaper — ChrisHarpon2 · 2026-10-26