secure-vibe-kit

Security-first Claude Code agents, commands, skills, and CI workflows — installable into any project with a single command.

What's included

| Folder | Contents | |--------|----------| | .claude/agents/ | Security assessment agents (orchestrator, scanner, tracer, reporter, threat modeler) | | .claude/commands/ | 30+ slash commands for git workflow, CI, deployment, security scanning | | .claude/skills/ | Security implementation skills, awareness training, prompt engineering guides, lessons library | | .github/workflows/ | CI pipeline (lint, test, security audit, build) + Claude Code review automation | | scripts/timestamp-helper.sh | Consistent timestamp generation used by security agents | | CLAUDE.md | Git conventions, branch rules, commit format, slash command reference, security reminders |

Quick start

# Install into your existing project
cd your-project
npx secure-vibe-kit init

# Update to latest version anytime
npx secure-vibe-kit update

# Check what's installed
npx secure-vibe-kit status

Commands

init

First-time installation. Copies all files and appends a marker-delimited block to your CLAUDE.md.

If .claude/agents/ already exists, it will warn you and suggest update instead (use --force to override).

update

Refreshes all files to the latest version. Directories using replace mode are wiped and recopied fresh. The CLAUDE.md marker block is found and replaced in-place — your custom content outside the markers is preserved.

status

Shows which components are currently installed in the project.

Options

| Flag | Description | |------|-------------| | --dry-run | Show what would be written without making changes | | --skip-claude-md | Skip the CLAUDE.md merge step | | --force | Overwrite without confirmation prompts |

How CLAUDE.md merge works

The kit wraps its content in HTML comment markers:

<!-- BEGIN secure-vibe-kit -->
[kit content here]
<!-- END secure-vibe-kit -->

• init: Appends the block to the end of your existing CLAUDE.md (or creates the file)
• update: Finds and replaces the existing block, leaving your custom content untouched

Copy modes

| Target | Mode | Behavior | |--------|------|----------| | .claude/agents/ | replace | Deletes and recreates the entire directory | | .claude/commands/ | replace | Deletes and recreates the entire directory | | .claude/skills/ | replace | Deletes and recreates the entire directory | | .github/workflows/ | merge | Copies kit workflows without deleting your own | | scripts/timestamp-helper.sh | file | Single file copy, preserves other scripts |

Maintainer workflow

To sync the latest files from the parent repo:

cd secure-vibe-kit
./scripts/sync-from-source.sh

Then bump the version in package.json and publish:

npm version patch
npm publish

License

MIT