Updated 2mo ago
by lachydotmcg
slopsec
A Claude Code skill that security-audits vibe-coded SaaS apps. 50 common ways AI-generated apps get pwned, turned into a repeatable checklist, severity scoring, and findings report!
24 GitHub stars (24)
Steady at 24 stars — no new stars in the 16 days since Sep 30.
- 1 skill (1 skills found in its SKILL.md files)
- 2 forks (2 forks)
- 2mo ago last update (Last updated 2mo ago)
Install
Skills CLI
npx skills add lachydotmcg/slopsec
Asks which agents to install it for. Add -g to install it for every project.
Claude Code
git clone https://github.com/lachydotmcg/slopseccp -r "slopsec" ~/.claude/skills/slopsec
Copies the slopsec skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project).
Plugin
/plugin marketplace add lachydotmcg/slopsec
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
slopsec
Security audit and hardening for vibe-coded SaaS apps. Use when reviewing, securing, hardening, or pen-testing an app — especially AI-generated / vibe-coded / "shipped fast" projects (Next.js, Supabase, Firebase, Express, serverless). Triggers: "is my app secure", "security review", "harden this", "check for vulnerabilities", "I'm about to launch", "audit before deploy", "exposed secrets", "leake…
SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.