# Vc Security

STRIDE + OWASP-based security audit with optional auto-fix.

- Repository: https://github.com/withkynam/vibecode-pro-max-kit (1164 stars)
- Category: Security
- License: MIT
- Last updated: 2026-06-21
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add withkynam/vibecode-pro-max-kit --skill vc-security -g -a claude-code -y`
Codex: `npx skills add withkynam/vibecode-pro-max-kit --skill vc-security -g -a codex -y`
Cursor: `npx skills add withkynam/vibecode-pro-max-kit --skill vc-security -g -a cursor -y`
Gemini CLI: `npx skills add withkynam/vibecode-pro-max-kit --skill vc-security -g -a gemini-cli -y`

## Description

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using vc-autoresearch pattern.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# vc-security, Security Audit

> **Output style:** Follow `process/development-protocols/communication-standards.md`, answer-first, plain language, no unexplained jargon, TL;DR on long responses.

Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With `--fix`, applies fixes iteratively using the vc-autoresearch guard pattern.

## When to Use

- Before a release or major deployment
- After adding auth, payment, or data-handling features
- Periodic security review (monthly/quarterly)
- Compliance check (SOC 2, GDPR, PCI-DSS prep)

## When NOT to Use

- Purely cosmetic changes (CSS, copy edits)
- No user-facing code or data handling involved

---

## Modes

| Mode | Invocation | Behavior |
|------|-----------|----------|
| Audit only | `/vc-security <scope>` | Scan → categorize → report |
| Audit + Fix | `/vc-security <scope> --fix` | Scan → categorize → fix iteratively |
| Bounded fix | `/vc-security <scope> --fix --iterations N` | Limit fix iterations to N |

---

## Audit Methodology

### 1. Scope Resolution
Expand the provided glob or `full` keyword into a file list. Read all in-scope files before analysis.

### 2. STRIDE Analysis
Evaluate each threat category systematically:
- **S**poofing, identity/authentication weaknesses
- **T**ampering, input validation, integrity controls
- **R**epudiation, audit logging gaps
- **I**nformation Disclosure, data leakage, secret exposure
- **D**enial of Service, rate limits, resource exhaustion
- **E**levation of Privilege, broken access control, RBAC gaps

### 3. OWASP Top 10 Check
Map findings to OWASP categories (A01, A10). See `references/stride-owasp-checklist.md` for per-category checks.

### 4. Dependency Audit
Run the appropriate package audit tool for the detected stack:
- Node.js: `pnpm audit`
- Python: `pip-audit`
- Go: `govulncheck`
- Ruby: `bundle audit`

The rest: https://github.com/withkynam/vibecode-pro-max-kit/blob/HEAD/.claude/skills/vc-security/SKILL.md