Open-Sourced Claude Code Security Audit Skill
kemalios · reddit · 2026-07-13
Working in web development and SEO, the author frequently inherits projects built by clients using AI tools like Lovable, Bolt, and Cursor, asking them to "make it real." They noticed a common fatal flaw across these projects: they appear complete, but altering a single URL could potentially expose all user data without anyone noticing.
The most prevalent vulnerabilities include:
- Supabase tables lacking row-level security, allowing anonymous users to directly read and write all rows.
- The servicerole key being exposed in the frontend bundle via a VITE prefix, completely bypassing RLS.
The author points out that while AI coding tools excel at "getting things to run," they fail to distinguish between "permitted design" and "critical security vulnerabilities." To solve this, they converted their personal audit checklist into a Claude Code skill. It automatically identifies the project stack and evaluates five domains: frontend, backend/data, auth/security, infrastructure, and recovery/ops. It outputs a scorecard with file paths and a remediation list, iterating until the score turns from 0/5 to green.
They emphasize that the skill's value lies not in being "smarter," but in altering default behaviors: unverifiable items always require manual review, and simply taking the user's word that "it's fine" won't automatically trigger a green light. A fixed rubric ensures that scores remain comparable and trackable over time. The project is open-sourced under MIT and can be installed directly into Claude Code.
More from coding & agent
- Cognition's SWE-2 uses a KKT duality argument in RL to shift the effort Pareto curve — YouJiacheng · 2026-09-11
- First-ever Three.js Conference lands in Paris, with a panel on AI-shortened design workflows — OdinLovis · 2026-09-11
- Data engineering, not agent frameworks, is the real bottleneck for enterprise AI agents — dhruv2038 · 2026-09-11
- RTK Terminal Compression Cuts Tokens but Leaves Your AI Coding Bill Unchanged — Bartaseth · 2026-09-11
- GPT-6 Astra beats Factorio with enemies in 44 in-game hours at ~$4,500 API cost — liminal_bardo · 2026-09-11
- Investment Analyst Asks How to Build a Claude-Based Diligence Agent Stack — Careless_Tie2286 · 2026-09-11