Copy this prompt into the AI assistant you're using.
Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/honorx12/VibeGuard.Loading the repository README…
Showing 24 of 24 collected skills.
Review code changes and test them: correctness, security-sensitive paths, AI-generated code scrutiny, regression tests and verification discipline. Use when reviewing a diff or PR or when remediation needs tests.
Review third-party agent skills, rules and scripts before adoption: provenance, licence, hidden instructions, exfiltration, downloads and excessive permissions. Use before installing or copying any external SKILL.md, plugin or agent rule.
Implement and verify accessibility and responsive behaviour: focus and hover states, skip links, mobile navigation, sticky headers, image alt text, colour contrast and mobile layouts. Use when building or reviewing UI components and pages.
Handle privacy and consent interfaces: cookie banner and preferences, UTM tracking, analytics configuration, privacy policy and terms drafting based on actual behaviour. Use when a site uses cookies, trackers, analytics or collects personal data.
Build and review forms: password visibility toggle, success and error states, confirmation dialogs, validation, and spam protection. Use when creating or auditing any user input form.
Implement optional site interactions: dark mode, site search, back-to-top, loading and skeleton states, scroll progress, copy-to-clipboard, print stylesheet, expandable FAQ and floating contact action. Use only when the feature fits the product's actual needs.
Measure and improve page-load performance: Core Web Vitals, bundle size, image compression, caching and font loading. Use when pages are slow, before launch, or when adding heavy assets or scripts.
Run a pre-launch production-readiness review: HTTPS, custom 404, broken links, primary call to action, deployment checks and rollback planning, mapping every launch checklist item to a responsible skill. Use before releasing or handing over a website or web…
Implement and verify SEO and sharing metadata: titles, descriptions, social preview image, favicon, sitemap, robots.txt, canonical URLs and accurate last-updated dates. Use when launching or restructuring a public site.
Secure AI-powered features and coding agents: prompt injection, unpermissioned AI access, invalid AI output and excessive AI permissions. Use when an LLM reads untrusted content, calls tools, runs code, queries data or generates HTML/SQL/URLs/commands.
Detect and fix object-level and tenant-level access problems in APIs: cross-user access, IDOR/BOLA, mass assignment, unsafe API inputs, poor tenant isolation and unsecured endpoints. Use when reviewing REST/GraphQL/RPC endpoints or multi-tenant data access.
Review and fix authentication and authorization: weak login, missing authz checks, admin routes, password reset, default credentials, MFA, account enumeration and client-only security. Use when building or auditing login, roles, admin areas or account…
Audit deployment and cloud configuration: open DB permissions, cloud misconfiguration, admin/debug exposure, verbose errors, exposed environments, logs, source maps, dashboards and DB roles. Use when reviewing IaC, hosting settings, Docker/Kubernetes config…
Protect sensitive data: unencrypted data in transit or at rest, password storage, key handling and sensitive information leakage through responses, URLs, caches and analytics. Use when handling PII, credentials, payments or health/financial data.
Assess dependency and build supply-chain risk: vulnerable and malicious packages, insecure CI/CD, untrusted build actions and unpinned dependencies. Use when adding packages, editing workflows, building images or auditing lockfiles.
Prevent injection and unsafe input handling: missing validation, SQL and NoSQL injection, command injection, insecure deserialization and path traversal. Use when code builds queries, shell commands, file paths or deserializes data.
Establish audit logging, security monitoring and tested backups: missing audit logs, missing alerts, untested backups. Use when assessing operational readiness, incident detection or recovery capability.
Protect payment and business-logic integrity: frontend-only payment verification, workflow abuse and race conditions. Use when handling checkout, subscriptions, credits, coupons, inventory, refunds or any multi-step stateful workflow.
Add and verify rate limiting and abuse controls on login, signup, reset, OTP, search, costly and AI endpoints. Use when endpoints can be brute-forced, scraped, spammed or used to run up cost.
Find and remediate exposed credentials: hardcoded secrets, public .env files, secrets in Git history, frontend bundles and logs, and exposed database credentials. Use when reviewing config, preparing a release, or after a suspected leak.
Orchestrate an evidence-based security audit of a web app, API or AI-powered project: map trust boundaries, select specialist skills, rank findings, plan fixes, verify and report. Use when asked to audit, harden or review security of a codebase, or before…
Review sessions, JWTs and OAuth/OIDC: weak session management, weak or exposed JWT secrets and validation, and misconfigured OAuth. Use when implementing or auditing login sessions, token issuance or social login.
Secure outbound requests, cross-origin policy and webhooks: SSRF, permissive CORS, unsigned webhooks, webhook replay and missing timeouts. Use when code fetches user-supplied URLs, configures CORS, or receives provider webhooks.
Secure the browser-facing surface: XSS, CSRF, file uploads, security headers, cookie flags, sensitive browser storage and open redirects. Use when building or auditing pages, forms, uploads, cookies or redirect logic.
Repository README source: README.md
Read the source README