Vibe-Shield – Static security scanner for AI-generated Next.js/Supabase code

Vibe-Shield is a zero-dependency, offline static security scanner published as @vibefoundry/vibe-shield, aimed at vulnerabilities common in agent-written code such as unauthenticated mutation routes, SQL injection, IDOR, exposed service-role keys and missing Row Level Security. It ships 91 signatures across eight categories (79 code rules plus 12 agent-integrity rules via audit-skills), and can generate an agent-ready fix prompt, SARIF/GitHub output for CI gating, and an Agent Skill plus MCP server via `init`. The README states the scanner is read-only by default, that grades apply only to the rules and files examined and are not a security certification, and that the npm commands may lag the v2.0.0 source tree until a release is published.