Open-Sourced Claude Code Security Audit Skill
kemalios · reddit · 2026-07-13
Working in web development and SEO, the author frequently inherits projects built by clients using AI tools like Lovable, Bolt, and Cursor, asking them to "make it real." They noticed a common fatal flaw across these projects: they appear complete, but altering a single URL could potentially expose all user data without anyone noticing.
The most prevalent vulnerabilities include:
- Supabase tables lacking row-level security, allowing anonymous users to directly read and write all rows.
- The servicerole key being exposed in the frontend bundle via a VITE prefix, completely bypassing RLS.
The author points out that while AI coding tools excel at "getting things to run," they fail to distinguish between "permitted design" and "critical security vulnerabilities." To solve this, they converted their personal audit checklist into a Claude Code skill. It automatically identifies the project stack and evaluates five domains: frontend, backend/data, auth/security, infrastructure, and recovery/ops. It outputs a scorecard with file paths and a remediation list, iterating until the score turns from 0/5 to green.
They emphasize that the skill's value lies not in being "smarter," but in altering default behaviors: unverifiable items always require manual review, and simply taking the user's word that "it's fine" won't automatically trigger a green light. A fixed rubric ensures that scores remain comparable and trackable over time. The project is open-sourced under MIT and can be installed directly into Claude Code.
More from coding & agent
- An MCP server signs every AI agent tool call into a verifiable Merkle chain — Funky_Chicken_22 · 2026-07-22
- Claude Code skill uses 10 Markdown rules to make outputs ADHD-friendly — alex_verem · 2026-07-22
- A Firecracker-based platform says it can host 6,000 AI agents on one 256 GB server — maritime_sh · 2026-07-22
- A better path to agent autonomy is running waves, finding friction, and iterating — JnBrymn · 2026-07-22
- AI agent designers map the visual and tonal cues behind companionship products — Unlikely-Platform-47 · 2026-07-22
- Coding agents are heading toward an AI-writes, AI-reviews, human-approves workflow — aftahi_ai · 2026-07-22