Open-Sourced Claude Code Security Audit Skill
kemalios · reddit · 2026-07-13
Working in web development and SEO, the author frequently inherits projects built by clients using AI tools like Lovable, Bolt, and Cursor, asking them to "make it real." They noticed a common fatal flaw across these projects: they appear complete, but altering a single URL could potentially expose all user data without anyone noticing.
The most prevalent vulnerabilities include:
- Supabase tables lacking row-level security, allowing anonymous users to directly read and write all rows.
- The servicerole key being exposed in the frontend bundle via a VITE prefix, completely bypassing RLS.
The author points out that while AI coding tools excel at "getting things to run," they fail to distinguish between "permitted design" and "critical security vulnerabilities." To solve this, they converted their personal audit checklist into a Claude Code skill. It automatically identifies the project stack and evaluates five domains: frontend, backend/data, auth/security, infrastructure, and recovery/ops. It outputs a scorecard with file paths and a remediation list, iterating until the score turns from 0/5 to green.
They emphasize that the skill's value lies not in being "smarter," but in altering default behaviors: unverifiable items always require manual review, and simply taking the user's word that "it's fine" won't automatically trigger a green light. A fixed rubric ensures that scores remain comparable and trackable over time. The project is open-sourced under MIT and can be installed directly into Claude Code.
More from coding & agent
- GPT-6 Astra beats Factorio with enemies in 44 in-game hours at ~$4,500 API cost — liminal_bardo · 2026-09-11
- Investment Analyst Asks How to Build a Claude-Based Diligence Agent Stack — Careless_Tie2286 · 2026-09-11
- Treating agents like 50 First Dates: a 3-layer context system so every conversation doesn't start from zero — evielync · 2026-09-11
- Running the Firefox MCP on Android via Termux, ngrok, and mcp-proxy — Nervous-Strain7544 · 2026-09-11
- SmolVM open-sources persistent computer infrastructure for agents that outlive chat sessions — aniketmaurya · 2026-09-11
- ARRM targets silent economic regressions in AI agents that functional tests miss — Beautiful_Belt_601 · 2026-09-11