Security on Vibe Coding

FFUF Web Fuzzing

Mon, 01 Jan 0001 00:00:00 +0000

This skill integrates the ffuf web fuzzer, letting Claude run authenticated fuzzing scans, auto-calibrate for noisy responses, and analyze results for real vulnerabilities during a penetration test.

Why a skill for this

Fuzzing tools have enough flags and calibration nuance that getting authenticated, low-noise scans right by hand takes real fuzzer expertise. Packaging that expertise as a skill makes competent fuzzing runs repeatable for anyone using it.

Threat Hunting with Sigma Rules

Mon, 01 Jan 0001 00:00:00 +0000

This skill uses Sigma detection rules — a vendor-neutral format for describing log-based threat signatures — to hunt for suspicious activity and analyze security events.

Why a skill for this

Sigma’s rule format is expressive but verbose to write and match by hand across large event logs. A skill that already knows the format turns threat hunting into a repeatable query task instead of a manual log-reading exercise.

Trail of Bits Security Skills

Mon, 01 Jan 0001 00:00:00 +0000

Trail of Bits’ security skills bring their own audit tooling — static analysis with CodeQL and Semgrep, variant analysis, and vulnerability pattern detection — into Claude Code.

Why a skill for this

Security auditing firms encode years of hard-won pattern knowledge into their tooling configs. Packaging that as a skill means Claude Code inherits Trail of Bits’ actual audit methodology instead of a generic security pass.

Security Best Practices Skill

Mon, 01 Jan 0001 00:00:00 +0000

This curated Codex skill applies a secure-coding checklist during code generation and review, catching common vulnerability classes as code is written.

Why a skill for this

Security issues are cheaper to prevent during generation than to catch in a later review pass. Baking a checklist into the generation step catches classes of bugs before they’re ever committed.

Security Threat Model Skill

Mon, 01 Jan 0001 00:00:00 +0000

This curated Codex skill walks through producing a structured threat model for a system — assets, trust boundaries, and attack surfaces — rather than an ad hoc security discussion.

Why a skill for this

Threat modeling is only useful if it’s structured and complete; an unstructured conversation tends to miss entire categories of risk. A skill that enforces the methodology produces a threat model that’s actually useful to a security reviewer.

Codacy

Mon, 01 Jan 0001 00:00:00 +0000

Codacy runs static analysis, security scanning, and coverage checks on every commit and pull request, surfacing issues as a quality score and letting teams enforce consistent standards across large codebases.

Sonar

Mon, 01 Jan 0001 00:00:00 +0000

Sonar has scanned code for bugs, vulnerabilities, and code smells since SonarQube’s early days, and now extends that static analysis foundation with AI Code Assurance and AI-powered review features that specifically check AI-generated code against the same quality gates used for human-written code.