vibe-security

What this skill does

# Vibe Security - Security Intelligence

Comprehensive security scanner and code analyzer for identifying vulnerabilities across multiple languages and frameworks.

## Prerequisites

Check if Node.js is installed:

```bash
node --version
```

If Node.js is not installed, install it based on user's OS:

**macOS:**

```bash
brew install node
```

**Ubuntu/Debian:**

```bash
sudo apt update && sudo apt install nodejs npm
```

**Windows:**

```powershell
winget install OpenJS.NodeJS
```

---

## Recommended AI Models

### For Best Security Analysis

We recommend using these AI models with Vibe Security for optimal security vulnerability detection and code fixing:

#### **Claude Opus 4.5** (Recommended)

- Most advanced model for comprehensive security analysis
- Superior reasoning capabilities for complex vulnerability detection
- Exceptional at identifying subtle security flaws and attack vectors
- Best for critical security audits, enterprise codebases, and production deployments
- Provides the most thorough security remediation strategies

#### **Claude Sonnet 4.5**

- Excellent balance of speed and security analysis depth
- Great at understanding security context and identifying vulnerabilities
- Provides safe remediation strategies with detailed explanations
- Ideal for daily development and most security workflows

#### **Claude Opus 4**

- Powerful for complex security audits and enterprise codebases
- Deep reasoning capabilities for advanced vulnerability analysis
- Best for critical security reviews and compliance requirements
- Recommended for production deployments and sensitive applications

#### **GPT-4o**

- Fast and efficient for security-aware code generation
- Good alternative with quick response times
- Excellent for CI/CD integration and automated scanning
- Cost-effective for large-scale projects

#### **Claude Sonnet 4**

- Faster alternative for quick security scans
- Good balance of speed and accuracy
- Suitable for rapid iteration during development

#### **o1-preview**

- Specialized for complex security architecture reviews
- Advanced reasoning for intricate vulnerability chains
- Best for security research and deep code audits

#### **GPT-4o-mini**

- Quick checks and preliminary scans
- Most cost-effective option
- Good for learning and educational use cases

> **Note**: If you're not using one of the recommended models above, consider upgrading for better security analysis results. Lower-tier models may miss subtle vulnerabilities or provide less accurate fix suggestions.

---

## How to Use This Skill

When user requests security work (scan, analyze, fix, audit, check, review vulnerabilities), follow this workflow:

### Step 1: Analyze Security Context

Extract key information from user request:

- **Language**: JavaScript, Python, Java, PHP, etc.
- **Framework**: Express, Django, Spring, Laravel, etc.
- **Vulnerability type**: SQL injection, XSS, CSRF, authentication, etc.
- **Scope**: Single file, directory, or full project

### Step 2: Run Security Analysis

**Advanced Analysis (Recommended):**

```bash
# AST-based semantic analysis (90% fewer false positives)
python3 .claude/skills/vibe-security/scripts/ast_analyzer.py "<file>"

# Data flow analysis (tracks tainted data from sources to sinks)
python3 .claude/skills/vibe-security/scripts/dataflow_analyzer.py "<file>"

# CVE & dependency vulnerability scanning
python3 .claude/skills/vibe-security/scripts/cve_integration.py .

# Supply chain security (malicious packages, typosquatting)
python3 .claude/skills/vibe-security/scripts/cve_integration.py . --ecosystem npm

# Infrastructure as Code security
grep -r "publicly_accessible.*=.*true" . --include="*.tf"
grep -r "privileged:.*true" . --include="*.yaml"
```

**Quick Pattern Scanning:**

```bash
# Use search utility for specific patterns
python3 .claude/skills/vibe-security/scripts/search.py "sql-injection" --domain pattern
python3 .claude/skills/vibe-security/scripts/search.py "javascript" --domain pattern --severity critical
```

### Step 3: Analyze Vulnerabilities by Severity

**Critical** (Fix immediately):

- SQL Injection
- Remote Code Execution
- Authentication Bypass
- Hardcoded Secrets

**High** (Fix soon):

- XSS (Cross-Site Scripting)
- CSRF
- Insecure Cryptography
- Authorization Issues

**Medium** (Fix in sprint):

- Missing Input Validation
- Information Disclosure
- Weak Password Policy
- Missing Security Headers

**Low** (Technical debt):

- Code Quality Issues
- Best Practice Violations
- Performance Concerns

### Step 4: Get Fix Suggestions

**ML-Based Fix Engine:**

```bash
# Get intelligent fix recommendations with test generation
python3 .claude/skills/vibe-security/scripts/fix_engine.py \
  --type sql-injection \
  --language javascript \
  --code "db.query(\`SELECT * FROM users WHERE id = \${userId}\`)"

# Output includes:
# - Fixed code with context-aware corrections
# - Detailed explanation of the fix
# - Auto-generated security test
# - Additional recommendations
# - Confidence score (0-100%)
```

### Step 5: Apply Security Fixes

**Auto-Fix with Rollback Support:**

```bash
# Apply fix with automatic backup
python3 .claude/skills/vibe-security/scripts/autofix_engine.py apply \
  --file src/database.js \
  --line 45 \
  --type sql-injection \
  --original "db.query(\`SELECT * FROM users WHERE id = \${userId}\`)" \
  --fixed "db.query('SELECT * FROM users WHERE id = $1', [userId])"

# Test your changes
npm test

# Rollback if needed (safe to experiment!)
python3 .claude/skills/vibe-security/scripts/autofix_engine.py rollback

# View fix history
python3 .claude/skills/vibe-security/scripts/autofix_engine.py history
```

**Systematic Manual Fixes:**

1. **Critical vulnerabilities first**
2. **Add input validation** - Whitelist, type checking, length limits
3. **Secure outputs** - Escape, encode, sanitize
4. **Fix authentication/authorization** - Strong passwords, MFA, RBAC
5. **Update cryptography** - Modern algorithms, secure random
6. **Test thoroughly** - Verify fixes don't break functionality
7. **Re-scan** - Confirm all vulnerabilities are resolved

### Step 6: Generate Reports

**Multiple Report Formats:**

```bash
# Beautiful HTML report with charts and statistics
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
  --format html \
  --output security-report.html

# SARIF format for GitHub Code Scanning integration
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
  --format sarif \
  --output results.sarif

# CSV for spreadsheet analysis
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
  --format csv \
  --output vulnerabilities.csv

# JSON for CI/CD pipelines
python3 .claude/skills/vibe-security/scripts/reporter.py scan-results.json \
  --format json \
  --output security-report.json
```

---

## Advanced Capabilities

### 1. Semantic Analysis with AST

Uses Abstract Syntax Tree parsing for accurate vulnerability detection:

- **Python**: Full AST analysis with taint tracking
- **JavaScript/TypeScript**: Heuristic + pattern-based analysis
- **Benefits**: 90% reduction in false positives, context-aware

### 2. Data Flow Analysis

Tracks user input from sources to dangerous sinks:

- Detects SQL injection, XSS, command injection through data flow
- Identifies tainted variables and their propagation
- Supports Python and JavaScript/TypeScript

### 3. Compliance Mapping

Maps every vulnerability to industry standards:

- **OWASP Top 10 2021**
- **CWE** (Common Weakness Enumeration)
- **MITRE ATT&CK** techniques
- **NIST** cybersecurity framework
- **PCI-DSS** payment card requirements

### 4. Supply Chain Security

Protects against malicious dependencies:

- Typosquatting detection
- Dependency confusion attacks
- Malicious install scripts
- Network operations in packages
- Supports: npm, PyPI, Maven, Gradle, Cargo, Go, RubyGems, NuGet, Composer

### 5. Infrastructure as Code

Scans cloud infrastructure configura