vbsec

A community Agent Skill by tanviet12 for checking AI-written code for security holes. It reads your code, traces data from user input to dangerous calls rather than matching strings, and reports each issue with why it's dangerous, how an attacker would use it, the current code and the fix. It's written for people who aren't security experts. What it catches - 21 common vulnerability types, including secrets in source code, SQL injection, broken access control, JWTs accepted without signature checks and wide-open CORS - Deep coverage of Go, PHP, TypeScript and JavaScript, Python and .NET, including Express, NestJS, Next.js, React, Django, FastAPI, Laravel and ASP.NET Core How it works - Scan the whole repo, only uncommitted changes, one commit, one pull request or the last few days of commits, or a plain folder without git. - Large repos are split across several agents in parallel and the results merged. - Reports are saved as files in vbsec-reports/, in English or Vietnamese, with a JSON summary for CI. - Install it as a skill for your coding agent, following the README's install steps. Good to know - The repo ships sample apps with planted bugs that it tests itself against. - It finds and explains issues; you decide which fixes to apply. - MIT licensed.