Airsc is free for everyone. If it helps you, support it with $2–$20.

Support
VISign in

Best Auth & security resources for vibe coders

Updated 15/10/2026

This guide is for vibe coders who let an AI agent run commands and edit files, and want to do it without losing data or leaking secrets. Most picks here guard the agent itself. A few help you check your own app for weak spots.

These resources let you block risky commands, scan skills and MCP configs before you install them, and look up known vulnerabilities. Some need setup or API keys, and the offensive tools should only be used on systems you own or have permission to test.

  1. PluginCaution

    cc-safety-net

    kenryu42

    CC Safety Net is a pre-execution guard that blocks destructive Git and file system commands, and prevents access to sensitive files for AI coding agents.

    1.6kMIT

    #1 · Why we picked it

    Quality 98 and beginner level; it blocks commands like rm -rf and force push, and keeps SSH keys and .env files out of reach, but its safety label is caution so read what it does first.
  2. Cursor ruleSafe

    artguard

    spiffy-oss

    This CLI scans AI agent skills, MCP server configs, and IDE rule files to detect security threats, privacy violations, and instruction-level attacks.

    32MIT

    #2 · Why we picked it

    Rated safe and beginner level; it scans skills, MCP configs and .cursorrules files for hidden malicious instructions before you install them.
  3. SkillCaution

    SkillSpector

    NVIDIA

    SkillSpector is a security scanner for AI agent skills, detecting vulnerabilities, malicious patterns, and prompt injection risks before installation.

    20kApache-2.0

    #3 · Why we picked it

    A popular scanner with 20,214 stars that checks skills for prompt injection and data exfiltration risks, though its label is caution.
  4. AgentSafe

    ai-bwrap

    didvc

    This tool runs AI coding agents like Claude Code inside a bubblewrap sandbox, limiting their access to only the current working directory for enhanced security.

    18MIT

    #4 · Why we picked it

    Rated safe; it runs Claude Code in a bubblewrap sandbox so the agent can only touch your current project folder (bubblewrap is a Linux tool).
  5. PluginSafe

    skills

    trailofbits

    A Claude Code plugin marketplace from Trail of Bits, offering skills to enhance AI-assisted security analysis, vulnerability detection, and audit workflows.

    7.5kCC-BY-SA-4.0

    #5 · Why we picked it

    Rated safe with quality 95 and beginner level; skills from Trail of Bits help your agent find vulnerabilities and run audit workflows.
  6. MCP serverSafe

    cve-mcp-server

    mukul975

    This production-grade MCP server gives Claude 27 security intelligence tools across 21 APIs for CVE lookup, EPSS scoring, CISA KEV, and more, enabling rapid security analysis.

    1.6kApache-2.0

    #6 · Why we picked it

    Rated safe with quality 95; it lets Claude triage a CVE using EPSS and CISA KEV data, though some of its 21 APIs may need keys.

How to choose

  • Start with guards and scanners (cc-safety-net, artguard, SkillSpector) before any offensive security tool.
  • Prefer the safe label and beginner level if you are not a security expert; treat caution as a prompt to read the code first.
  • Check setup needs: some MCP servers need API keys, and tools like ai-bwrap depend on your operating system.
  • Only use penetration testing tools such as hexstrike-ai or MCP-Kali-Server on systems you own or are allowed to test.

FAQ

Which resource should I install first?

Install a command guard such as cc-safety-net, and scan every new skill with artguard. These two steps cover the most common mistakes.

Does a safe label mean zero risk?

No. It means our checks found nothing alarming. Still review permissions, and run agents in a sandbox when you can.

Are the penetration testing tools safe for beginners?

Most are intermediate or advanced. They can act on real systems, so use them only with permission and ideally in a test environment.