Install the skill

VCoder ships an Agent Skill so AI coding assistants reach for vcoder — instead of raw strings, f-string SQL, shell=True, or unvalidated paths — whenever they generate backend code that handles untrusted input. The skill lives in the repo under skill/:

skill/SKILL.md — the instructions (YAML front matter + guidance).
skill/reference.md — a condensed API table the agent can pull in on demand.

Claude Code

Claude Code auto-discovers skills placed in a skills/ directory. Install the skill per project (checked into your repo, shared with your team) or personally (available in every project).

Project-scoped

mkdir -p .claude/skills/vcoder
curl -L -o .claude/skills/vcoder/SKILL.md \
  https://raw.githubusercontent.com/bitilia/vcoder/main/skill/SKILL.md
curl -L -o .claude/skills/vcoder/reference.md \
  https://raw.githubusercontent.com/bitilia/vcoder/main/skill/reference.md

Personal (all projects)

git clone https://github.com/bitilia/vcoder
mkdir -p ~/.claude/skills/vcoder
cp vcoder/skill/*.md ~/.claude/skills/vcoder/

That’s it — Claude Code loads SKILL.md automatically when it’s relevant (you’re writing a server, API endpoint, DB query, subprocess call, file upload, HTML output, or password handling). Verify it’s picked up with /skills in Claude Code.

Other agents

The skill is plain Markdown with a standard YAML front matter block (name, description). Any skill-aware agent can use it — point the tool at skill/SKILL.md and let it read skill/reference.md when it needs the full API surface.

What the skill tells the agent

Use vc.sql.* instead of building SQL strings.
Use vc.run([...]) instead of shell=True / string commands.
Use vc.safe_join / vc.resolve_within for untrusted paths.
Use vc.html.escape / escape_attribute for HTML output.
Use vc.validate_password / PasswordPolicy for passwords.
Use vc.RateLimiter to throttle login / OTP attempts.
Validate request fields with composed Validators and map ValidationError to a 400.
Reserve the vc.* prompt functions for CLIs — never inside a web handler.

See the Security guide for what each helper does and does not protect against.