NEVER get hacked again while vibecoding!
概览
End-to-end web app security for people who build by prompting. It meets a project wherever it actually is — idea, half-built, live with users, or on fire — audits what exists on disk instead of what the user says exists, and returns a prioritised plan with the fixes written as working code. Never answer a security question from priors. A builder's description of their app is unreliable — not because they lie, but because they don't know which details matter, and because AI-generated code contains things they never saw written. A finding you verified beats ten you predicted. The corollary is the part most tools get wrong: You can say a specific gate passed. You can say a specific check found nothing. Those are different claims, and the difference is the whole point. Stage and architecture lane, both read off the filesystem. The skill does not ask — self-reports are systematically optimistic, and the files know. If security/data-map.
README
以下为原文 README 节选，完整内容请查看原文。
End-to-end web app security for people who build by prompting.
It meets a project wherever it actually is — idea, half-built, live with users, or on fire — audits what exists on disk instead of what the user says exists, and returns a prioritised plan with the fixes written as working code.
The one rule
Audit before you advise. Every time. No exceptions.
Never answer a security question from priors. A builder’s description of their app is unreliable — not because they lie, but because they don’t know which details matter, and because AI-generated code contains things they never saw written. A finding you verified beats ten you predicted.
The corollary is the part most tools get wrong:
Never tell the user they are secure.
You can say a specific gate passed. You can say a specific check found nothing. Those are different claims, and the difference is the whole point.
How it works
1. Locate the project. Stage and architecture lane, both read off the filesystem. The skill does
not ask — self-reports are systematically optimistic, and the files know. If security/data-map.yaml
is absent, Stage 0 is incomplete no matter how much code exists.
2. Audit, cheapest tier first. Two offline scripts and one consent-gated live probe, then the differential authorization test that no scanner can do. It stops and reports early if Tier 0 finds something critical — a user with an open database does not need Tier 3 style notes.
3. Filter before reporting. Every draft finding runs through a false-positive catalog first. This is not optional, and it is the step that decides whether the report is useful or noise.
4. Report by chain, not by severity column. Every real breach in the research record is a chain. The solo-founder threat model has no SOC, no WAF, and a time-to-detect of whenever they next look, so composite risk behaves like the product of exploitabilities, not the max.
The stage ladder
Eleven stages, each with a mechanically verifiable exit gate, plus an out-of-band incident track. Stages 0–2 are cheap and are the ones that get skipped.
| Stage | Name | Exit gate proves |
|---|---|---|
| 0 | Data decisions | Three files exist; no field lacks a reader |
| 1 | Accounts | Hardware keys on five root accounts; agent scoped |
推荐工具
换一个关键词，或者移除筛选条件。
安装
npx skillfish add itsrealaj/never-get-hacked-skill