Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

vc-security — Security Audit · withkynam | DecimalAI

securityby withkynam

vc-security — Security Audit

withkynam/vc-security

Source withkynam/vibecode-pro-max-kit ↗License MIT

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using vc-autoresearch pattern.

SkillScore87Maintained

Automatic

Security & AppSec pack

Last verified 8/16/2026

What it changes

Passed 20 of 23 test cases with the skill, and 14 of 23 without it.

Without skill61%

With skill87%

Checks it passed that the model alone missed

Specifies the `--iterations` flag to limit fix attempts.
Declines to run a security audit for non-code copy editing.
Declines security auditing for pure CSS styling modifications.

and 4 more in the full report

7 fixed13 passed either way2 still failing1 broke

Pass-rate lift: +26 pp
Tokens: +45%
Agent turns: 0%
Response time: -30%

Model gemini-3.6-flashMeasured 8/16/2026v120 of 23 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/withkynam-vc-security/SKILL.md https://app.decimal.ai/s/withkynam-vc-security/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add withkynam-vc-security, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/withkynam-vc-security/ and pins it in .decimal/skills.lock

decimalai skills add withkynam-vc-security

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/withkynam-vc-security/SKILL.md https://app.decimal.ai/s/withkynam-vc-security/SKILL.md

Raw file: /s/withkynam-vc-security/SKILL.md ↗ · machine-readable summary at /s/withkynam-vc-security.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 7

Prompt

We have some typos and awkward phrasing in our user documentation files under `docs/user-guide/`. Please proofread these markdown files and fix copy errors.

What was checked, without and with the skill
Checked	Without skill	With skill
Declines to run a security audit for non-code copy editing.	Missed	Passed

case-05 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md135 lines4 files

vc-security — Security Audit

Output style: Follow process/development-protocols/communication-standards.md — answer-first, plain language, no unexplained jargon, TL;DR on long responses.

Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With --fix, applies fixes iteratively using the vc-autoresearch guard pattern.

When to Use

Before a release or major deployment
After adding auth, payment, or data-handling features
Periodic security review (monthly/quarterly)
Compliance check (SOC 2, GDPR, PCI-DSS prep)

When NOT to Use

Purely cosmetic changes (CSS, copy edits)
No user-facing code or data handling involved

Modes

Mode	Invocation	Behavior
Audit only	`/vc-security <scope>`	Scan → categorize → report
Audit + Fix	`/vc-security <scope> --fix`	Scan → categorize → fix iteratively
Bounded fix	`/vc-security <scope> --fix --iterations N`	Limit fix iterations to N

Audit Methodology

1. Scope Resolution

Expand the provided glob or full keyword into a file list. Read all in-scope files before analysis.

2. STRIDE Analysis

Evaluate each threat category systematically:

Spoofing — identity/authentication weaknesses
Tampering — input validation, integrity controls
Repudiation — audit logging gaps

Track record

Benchmark

20 / 23

test cases passed, vs 14 / 23 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

withkynam / vibecode-pro-max-kit

.claude/skills/vc-security/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 3 files

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

vc-security — Security Audit

When to Use

When NOT to Use

Modes

Audit Methodology

1. Scope Resolution

2. STRIDE Analysis

Track record

Benchmark

Adoption

SkillSafety

Source

Related skills