Can I run a quick check instead of a full audit?

Yes, using the '/vcp-audit quick' command performs a high-speed scan focusing only on critical and high-severity rules without the overhead of the full multi-agent team mode.

How does vcp-audit reduce false positives?

It employs a multi-step validation process that traces data flow, checks for mitigating factors like framework defaults, and verifies the technology context before reporting a finding.

What is 'Team Mode' in vcp-audit?

Team Mode spawns specialized sub-agents for different domains like backend, frontend, and architecture to parallelize the scanning process, significantly reducing audit time.

Which compliance frameworks are supported?

The skill supports GDPR, PCI-DSS, and HIPAA by mapping specific VCP security standards to the requirements of these regulatory frameworks.

Does it scan for hardcoded secrets?

Yes, it includes a dedicated scanner for committed secrets in environment files, configuration files, and credentials folders, mapping findings to CWE-798.

VCP Security & Compliance Audit

Name: VCP Security & Compliance Audit
Author: Z-M-Huang

byZ-M-Huang

•

보안 및 테스팅

Performs comprehensive security and compliance audits against VCP standards to ensure AI-generated code is secure and production-ready.

The vcp-audit skill provides a robust framework for auditing codebases against the Vibe Coding Protocol (VCP) standards, specifically designed to secure AI-generated code. It supports multiple operational modes including full deep-scans, specialized compliance framework checks for GDPR, PCI-DSS, and HIPAA, and rapid release-readiness assessments. By utilizing a multi-agent team mode for parallelized scanning and a rigorous validation process to eliminate false positives through data-flow analysis, it ensures that security vulnerabilities, architectural flaws, and sensitive data exposures are identified with high precision.

주요 기능

01Automated false positive validation via data flow and context analysis

026 GitHub stars

03Framework-specific compliance checks for GDPR, PCI-DSS, and HIPAA

04Multi-standard auditing covering security, architecture, and performance

05Integrated detection for hardcoded secrets and sensitive configuration files

06Parallelized scanning using multi-agent team mode for large codebases

사용 사례

01Verifying AI-generated code against security standards before merging to production

02Automating regulatory compliance audits for healthcare and fintech projects

03Running rapid release-readiness checks to identify critical security blockers

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add z-m-huang/vcp vcp-audit

For use in Claude.ai and ChatGPT

Download Skill