vibe-coding-security-review
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a template for performing security audits. It contains regex patterns and instructional guidance for detecting vulnerabilities such as hardcoded credentials (e.g., AWS keys, private keys), injection flaws, and insecure dependencies.
- [SAFE]: The 'Hardcoded Secrets' check (Check 1) correctly identifies patterns for API keys and private keys for the purpose of flagging them in the user's source code, not for exfiltration.
- [SAFE]: The skill instructs the agent to search for known vulnerable versions of common packages (lodash, axios, django, etc.), which is a standard practice for identifying supply chain risks.
- [SAFE]: The output format and integration steps are designed to provide feedback to the developer or a build system, which is consistent with its stated purpose as a 'vibe-coding' security gate.
Audit Metadata