vibe-shield SKILL.md skillA
vibe-shield from avivgerz-hue/vibe-shield is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add avivgerz-hue/vibe-shield/vibe-shield@v1.0.0Pins v1.0.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- avivgerz-hue/vibe-shield
- Path
SKILL.md- Versions recorded
- 2
- Latest version
- v1.0.0, committed Nov 7, 2026
- First version recorded
- Nov 7, 2026
- Size
- 6,260 bytes
- Repository stars
- 4
- License
- MIT
Audit any change for AI-introduced security bugs (leaked keys, unguarded API routes, disabled Row Level Security, SQL injection, prompt injection, poisoned MCP servers) and fix them before reporting a task as done. Use whenever you write or modify application code, API routes, server actions, database migrations, auth logic, environment variables, LLM calls, webhook handlers, agent skills or MCP configuration.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# vibe-shield You are not allowed to say "done" until the code you just wrote passes a security audit. AI coding agents ship a specific, repeatable class of vulnerability: a `SUPABASE_SERVICE_ROLE_KEY` behind a `NEXT_PUBLIC_` prefix, a `DELETE` route handler with no session check, a `CREATE TABLE` with no `ENABLE ROW LEVEL SECURITY`, a tool whose `execute` forwards model output into `exec`. These are not exotic — they are the default shape of code written quickly by something optimising for "it works". This skill is the second pair of eyes. ## When to run Run the audit **after every change that touches**: - an API route, route handler, server action, RPC endpoint or GraphQL mutation - authentication, session, role, permission or ownership logic - a database migration, policy, grant, schema or Supabase table - an environment variable, config file, `.env*` file or build config - anything calling an LLM, a tool, a webhook, a shell command or the filesystem - `.claude/`, `.cursor/`, `AGENTS.md`, `mcp.json` or any skill/config file If you did not touch any of those, you do not need to run it. ## The loop ```bash # 1. Scan (a whole-repo scan finishes in well under a second) …
Read the whole file at its exact version.
How to install
mdr add avivgerz-hue/vibe-shield/vibe-shield@sha256:95f5b4d3a28ecbb1The line at the top of this page pins the label v1.0.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_hjk2bxauygzl6xsu)
0 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, all committed on Nov 7, 2026.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v1.0.0 latest | 2026-11-07 | 4dee5ed | 6,260 B | A | view · diff |
| v1.0.0 | 2026-11-07 | b76bdcd | 5,969 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6260 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
avivgerz-hue/vibe-shield · 4 stars · license MIT · pushed 2026-11-07 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_hjk2bxauygzl6xsu GET https://markdownregistry.com/api/v1/resolve?ref=avivgerz-hue/vibe-shield/vibe-shield GET https://markdownregistry.com/api/v1/blob/95f5b4d3a28ecbb151080a33ebfed60b7d3562d1d9923330be373638c86caf82
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.