{
  "markdown": "# VibeGuard — Security Auditor for Vibe-Coded Projects\n\n**170+ vulnerability checks · 24 categories · 3 commands · pre-commit secret blocking**\n\nBuilt for projects that were vibe-coded with AI and shipped without a security review.\n\n## Commands\n\n| Command | What It Does | Auto-invoked? |\n|---------|-------------|---------------|\n| `/vibeguard:audit` | Scans project, produces a findings table | Yes — Claude runs it when you ask about security |\n| `/vibeguard:fix` | Patches vulnerabilities from the audit | No — you must invoke manually |\n| `/vibeguard:harden` | Adds security infrastructure proactively | No — you must invoke manually |\n\n### Audit (the scanner)\n\n```bash\n/vibeguard:audit              # full project scan\n/vibeguard:audit auth         # focus on authentication issues\n/vibeguard:audit src/api/     # scan specific directory\n/vibeguard:audit rls          # focus on Supabase RLS\n/vibeguard:audit llm          # focus on LLM/AI security\n```\n\nProduces a severity-rated table. Never changes code.\n\n### Fix (the patcher)\n\n```bash\n/vibeguard:fix all            # fix everything from the audit\n/vibeguard:fix critical       # fix only CRITICAL severity\n/vibeguard:fix critical high  # fix CRITICAL and HIGH\n/vibeguard:fix 1,3,7          # fix specific findings by number\n```\n\nShows before/after for every change. Asks for input when decisions are needed.\n\n### Harden (proactive security)\n\n```bash\n/vibeguard:harden             # full hardening (shows plan first)\n/vibeguard:harden headers     # add security headers only\n/vibeguard:harden middleware  # add security middleware stack\n/vibeguard:harden validation  # add input validation to endpoints\n/vibeguard:harden env         # cleanup env vars, create .env.example\n/vibeguard:harden logs        # strip/gate console.logs\n```\n\nAlways shows a plan and asks for approval before making changes.\n\n### Pre-Commit Hook\n\nAutomatically blocks `git commit` if staged files contain hardcoded secrets (API keys, private keys, connection strings, .env files). No action needed — it's active once the plugin is installed.\n\n## What It Catches\n\n| Category | Checks | Highlights |\n|---|---|---|\n| Injection Attacks | 9 | SQL, NoSQL, command, SSTI, GraphQL |\n| XSS | 5 | Reflected, stored, DOM, React, SVG |\n| Auth & Sessions | 9 | Hardcoded secrets, JWT misuse, broken reset |\n| Authorization | 7 | IDOR, mass assignment, path traversal |\n| Rate Limiting | 7 | Auth, API, uploads, pagination |\n| CSRF | 2 | Missing tokens, token in GET |\n| Security Headers | 9 | CSP, HSTS, CORS, all the headers |\n| Data Exposure | 11 | Console.log leaks, env prefix leaks, EXIF |\n| File Uploads | 3 | Type/size/origin issues |\n| Dependencies | 4 | CVEs, wildcards, lockfile, SRI |\n| Crypto | 5 | Math.random, timing attacks, weak algos |\n| DoS | 4 | ReDoS, XML bombs, memory |\n| WebSockets | 4 | Auth, origin, message injection |\n| Deployment | 5 | Debug mode, defaults, Docker |\n| API Security | 4 | Validation, batch abuse, exposed docs |\n| Client-Side | 4 | Client-only auth, prototype pollution |\n| Next.js/React | 9 | Server Actions, Route Handlers, App Router, SSR props |\n| Database | 4 | Default creds, exposed ports |\n| SSRF | 2 | URL fetching, DNS rebinding |\n| Race Conditions | 3 | Double-spending, TOCTOU |\n| Webhooks & Payments | 4 | Stripe signatures, price manipulation |\n| Vibe-Coding Antipatterns | 8 | TODO auth, AI artifacts, mock code |\n| **Auth Providers** | **10** | NextAuth/Auth.js, Clerk, Lucia misconfigs |\n| **Supabase/BaaS** | **22** | RLS, service_role, storage, realtime |\n| **LLM/AI** | **12** | Prompt injection, output safety, cost abuse |\n\n## Install\n\n```bash\n# From a custom marketplace\n/plugin marketplace add geraldang702/vibeguard\n/plugin install vibeguard\n\n# Or install directly from GitHub\n/plugin install vibeguard --repo geraldang702/vibeguard\n```\n\n### Local Testing\n\n```bash\ngit clone https://github.com/geraldang702/vibeguard.git\nclaude --plugin-dir ./vibeguard\n```\n\n## Design\n\nThe plugin enforces a strict **audit-first flow**:\n\n1. **Scan** — `/vibeguard:audit` detects your stack, reads only the relevant reference files, scans everything\n2. **Report** — Presents a findings table with severity, file, line number, and plain-English explanations\n3. **Ask** — Stops and asks what you want to fix. Never auto-patches.\n4. **Fix** — `/vibeguard:fix` only runs when you explicitly invoke it, shows before/after for every change\n5. **Prevent** — The pre-commit hook blocks future secrets from being committed\n\nThe `fix` and `harden` skills have `disable-model-invocation: true` — Claude will never run them on its own, even if it thinks it should. You stay in control.\n\n## Project Structure\n\n```\nvibeguard/\n├── .claude-plugin/\n│   ├── plugin.json              # plugin identity\n│   └── marketplace.json         # marketplace catalog\n├── skills/\n│   ├── audit/                   # /vibeguard:audit (auto-invoked when relevant)\n│   │   ├── SKILL.md\n│   │   └── references/\n│   │       ├── threat-matrix.md # 24 categories\n│   │       ├── supabase-baas.md # 22 BaaS checks\n│   │       └── llm-security.md  # 12 AI checks\n│   ├── fix/                     # /vibeguard:fix (manual only)\n│   │   └── SKILL.md\n│   └── harden/                  # /vibeguard:harden (manual only)\n│       └── SKILL.md\n├── hooks/\n│   └── hooks.json               # pre-commit secret blocker config\n├── scripts/\n│   └── secret-scanner.sh        # secret detection script\n├── LICENSE\n└── README.md\n```\n\n## Contributing\n\nPRs welcome. To add a vulnerability check:\n\n1. Add it to `skills/audit/references/threat-matrix.md` under the right category\n2. Follow the format: `### N.N Name` → `Detect:` → `Fix:`\n3. Add it to the scan priority list in `skills/audit/SKILL.md` if it's P0 or P1\n\n## License\n\nMIT\n",
  "bytes": 5746,
  "sha": "769fe07ceecacf2d2451426e2c18db848c794513054173b86b28f94a19c406f2",
  "repo_slug": "geraldang702/vibeguard",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_geraldang702_vibeguard_vibeguard_bae8d762/readme"
}