Automatic OWASP security checks on generated code. Use when: any code is generated in the pipeline. Triggers: internal use only.
/plugin marketplace add timequity/vibe-coder/plugin install vibe-coder@vibe-coderThis skill inherits all available tools. When active, it can use any tool Claude has access to.
scripts/security_scan.pyOWASP validation on every code generation. User doesn't see.
For common issues:
| Issue | Auto-Fix |
|---|---|
| Raw SQL | Convert to parameterized |
| Missing sanitization | Add input validation |
| Exposed secrets | Move to env vars |
| Missing auth check | Add middleware |
Run OWASP checks programmatically:
python scripts/security_scan.py --path /project/path
python scripts/security_scan.py --path /project/path --json # JSON output
python scripts/security_scan.py --fail-on high # Fail on high+ severity
Checks: SQL injection, hardcoded secrets, unsafe eval, command injection, insecure HTTP.
| Result | Action |
|---|---|
| All pass | Continue silently |
| Auto-fixed | Continue, log internally |
| Can't fix | Block + ask user to clarify |
User sees nothing unless there's an unfixable security issue.
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.