{"id":"effae286-8118-407a-b4ed-7c922a7ba61c","slug":"barkinsarikartal-vibe-check","kind":"skill","name":"vibe-check","summary":"vibe-check is an agent skill that takes your project through 84 checks for all kinds of shortcomings and errors in your project","owner":"barkinsarikartal","repoUrl":"https://github.com/barkinsarikartal/vibe-check","license":"MIT","licenseTier":"permissive","trust":"community","stars":12,"match":null,"fewStars":false,"format":"skill","createdAt":"2026-10-17T11:04:48.000Z","addedAt":"2026-10-22T00:01:00.512Z","logoUrl":"https://avatars.githubusercontent.com/u/43545365?u=393be82f35189d4a18391399fe6cb77c7a198113&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["writing"],"tags":[],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-25T23:40:16.406Z","sample":false,"url":"https://conduits.dev/tools/barkinsarikartal-vibe-check","language":"Python","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"

\n \"vibe-check:\n

\n\n

\n \"MIT\n \"Install\n \"Claude\n \"84\n

\n\n

\n \"GitHub\n \"GitHub\n \"Contributors\"\n \"Last\n

\n\n

\n \"Python\"\n \"Markdown\"\n

\n\n

Jump to install ↓

\n\n---\n\nAI-built apps usually work on the happy path. What gets skipped is everything nobody asked for: the admin key that ends up in the browser bundle, the webhook nobody verifies, rate limits on some routes but not others, backups no one has ever restored, a privacy policy that doesn't match what the code collects.\n\nvibe-check is an agent skill that takes your project through 84 checks for exactly those things and writes the result to `VIBE_CHECK.md`:\n\n```text\nrecon -> 84 checks -> evidence for each -> VIBE_CHECK.md -> fixes, when you ask\n```\n\nIt reads your code and doesn't change it. Item numbers never change, so you can rerun it before every release and compare results (\"#29 is still open\").\n\n## What it checks\n\n| Area | Items | For example |\n|---|--:|---|\n| Secrets and credentials | 9 | keys in the client bundle, `.env` in git history, weak JWT secrets |\n| Auth and access control | 10 | missing ownership checks, IDOR, admin pages guarded only in the browser |\n| Input and injection | 9 | SQL and NoSQL injection, XSS, SSRF, path traversal, file uploads |\n| Database and storage | 7 | Supabase RLS, Firebase rules, public buckets, connection pooling |\n| API surface | 7 | CORS, rate limits, unsigned webhooks, prices trusted from the client |\n| Production exposure | 8 | debug pages, source maps, security headers, staging left public |\n| Dependencies and review | 4 | known vulnerabilities, outdated packages, security scans in CI |\n| AI features | 2 | prompt injection, AI tools that skip permission checks |\n| Operations | 7 | logs, monitoring, backups and restore, rollback |\n| Architecture and scale | 7 | load tests, in-memory sessions, queues, single points of failure |\n| Hands-on testing | 2 | OWASP ZAP baseline, a Burp Suite test plan |\n| Legal and business | 8 | privacy policy vs. what the code collects, terms, DMCA, trademark |\n| Discoverability and support | 4 | SEO, Bing and Google consoles, store listing, support URL |\n\nThe full list, with where to look and what \"good\" means for each item, is in [`checklist.md`](skills/vibe-check/references/checklist.md).\n\n## Install\n\n```bash\nnpx skills add barkinsarikartal/vibe-check -g -a claude-code\n```\n\n`-g` installs it for all your projects; leave it out to add it to the current project only. Leave out `-a claude-code` to choose other agents (Codex, Cursor, OpenCode and more).\n\n
\nManual install\n\n```bash\ngit clone https://github.com/barkinsarikartal/vibe-check.git\ncp -r vibe-check/skills/vibe-check ~/.claude/skills/\n```\n\nFor a single project, copy it into that project's `.claude/skills/` instead.\n\n
\n\nRequires Python 3 for the two helper scripts (standard library only). Git is optional; without it, the history scan is skipped.\n\n## Use\n\nOpen your project in your agent and ask in plain words:\n\n| What you want | Say something like |\n|---|---|\n| A full audit before launch | \"vibe check this project\" |\n| A yes/no on launching | \"is this ready for production?\" |\n| Part of the list | \"only items 1–30\" or \"just the security items\" |\n| Fixes for what it found | \"fix G1 to G3\" |\n| A rerun after fixing | \"vibe check again\" (the report gains a \"Changes since last check\" section) |\n\nThe chat reply stays short: the verdict, the critical gaps and counts for the rest. Everything else is in `VIBE_CHECK.md`.\n\n## What you get\n\nEach item gets one of five verdicts:\n\n| Verdict | Meaning |\n|---|---|\n| `OK` | Checked and handled, with the evidence (`file:line`, config, command output) |\n| `GAP` | A real problem, rated `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`, with a write-up and a fix |\n| `OWNER` | Only you can check it (dashboards, accounts, legal); the exact steps are included |\n| `N/A` | Doesn't apply to this app, and what was searched to confirm that |\n| `SKIP` | Applies, but isn't worth doing yet, with the reason |\n\nThe report has four parts: gaps ranked by severity, owner checks, recommended skips, and the full 84-row table. Below is an excerpt from a test run on a deliberately broken demo app (Next.js, Supabase, Stripe, OpenAI):\n\n```markdown\n**Tally:** 84 items · 15 OK · 55 gaps (16 critical, 23 high, 11 medium, 5 low) · 5 owner checks · 7 N/A · 2 skip\n\n### G4. Pro can be had for free: CRITICAL (items #15, #31, #32)\n**What:** There are four separate holes:\n- **The unlock is client-only.** `/pro` saves `isPro` in localStorage whenever the URL\n contains `?success` (`app/pro/page.tsx:12-13`). Visiting `/pro?success=1` unlocks Pro.\n- **The client sets the price.** The server passes `priceAmount` to Stripe as\n `unit_amount` (`app/api/checkout/route.ts:5,15`).\n- **The webhook is unsigned.** No `stripe.webhooks.constructEvent`; anyone can POST a\n fake `checkout.session.completed` (`app/api/stripe/webhook/route.ts:5`).\n...\n\n| # | Item | Status | Evidence / note |\n|----|--------------------------|--------|----------------------------------------------------------|\n| 17 | SQL injection | OK | All DB access goes through the supabase-js query builder; no raw SQL or `.rpc` |\n| 21 | Insecure file uploads | GAP (HIGH) | G8: only `accept=\"image/*\"` on the client (`app/upload/page.tsx:29`) |\n| 44 | No backup or restore plan | GAP (HIGH) | G13: no backup or restore notes in the repo |\n| 83 | Trademarking the brand | OWNER | Name clearance can't be seen from the repo; search steps in section 2 |\n```\n\n> [!NOTE]\n> Legal and business items (privacy policy, terms, DMCA, trademark, patent) come with concrete gaps and an honest opinion. They are not legal advice.\n\n## Safety\n\n- The audit is read-only: no code changes, no commits.\n- Live checks are a few passive GET requests to your own deployed site (headers, `robots.txt`, `/.env`, source maps). Nothing active runs unless you ask: no scanners, fuzzing or login attempts.\n- Secret values never appear in the report. `verify_report.py` fails the report if one slips in.\n\n## Platform support\n\n| Agent | Status |\n|---|---|\n| Claude Code | Tested (results below) |\n| Codex, Cursor, OpenCode and other agents that read `SKILL.md` | Should work when installed with `npx skills add`; not tested yet |\n\n## Test results\n\nThe skill was tested on two deliberately broken demo apps (Next.js + Supabase, FastAPI + React) with 38 planted problems, running the same prompts with and without it:\n\n| | With vibe-check | Without |\n|---|---|---|\n| Checks passed (52 across 3 prompts) | 97% | 82% |\n| Planted problems found | 38 / 38 | 38 / 38 |\n| Verdict on every one of the 84 items | yes | no |\n| Average time per run | about 10 min | about 6 min |\n\nWithout the skill, the agent still finds the obvious bugs. What it skips is the rest of the list: backups, monitoring, legal pages, trademark, load tests, rollback. That's the part vibe-check adds.\n\n
\nRunning the evals yourself\n\nThe demo apps live in `evals/fixtures/`. Fake keys are generated when a fixture is built, so nothing secret-shaped is stored in this repo.\n\n```bash\nmkdir -p /tmp/vc/fakes\n\n# 1. Build a test app\npython3 evals/build_fixture.py splitly /tmp/vc/splitly-full-audit-with_skill \\\n > /tmp/vc/fakes/splitly-full-audit-with_skill.fakes.json\n\n# 2. Run your agent on /tmp/vc/splitly-full-audit-with_skill with the prompt from\n# evals/evals.json. Save its VIBE_CHECK.md and final_reply.md to:\n# workspace/iteration-1/eval-1-splitly-full-audit/with_skill/run-1/outputs/\n\n# 3. Score it\npython3 evals/grade.py workspace/iteration-1 --fakes-dir /tmp/vc/fakes\n```\n\n`workspace/` is in `.gitignore`.\n\n
\n\n## Repo layout\n\n```text\nskills/vibe-check/\n├── SKILL.md workflow, verdict rules, report template\n├── references/checklist.md the 84 items: where to look, what \"good\" means, usual severity\n└── scripts/\n ├── recon.py stack fingerprint + redacted secret scan of files and git history\n └── verify_report.py checks the report covers every item with evidence; prints the tally\nassets/banner.svg the README banner\nevals/\n├── fixtures/ two broken demo apps used for testing\n├── build_fixture.py turns a fixture into a git repo with generated fake keys\n├── evals.json test prompts and pass/fail checks\n└── grade.py scores a test run\n```\n\n## Update and uninstall\n\n```bash\nnpx skills update vibe-check\nnpx skills remove vibe-check\n```\n\nIf you installed manually, delete `~/.claude/skills/vibe-check` (or the copy in your project's `.claude/skills/`).\n\n
\nContributing\n\nIssues and pull requests are welcome, especially new checks and better detection for stacks the checklist covers thinly.\n\n- Item numbers are permanent. Add new items at the end (85, 86, …) and never renumber, because reports refer to items by number.\n- Run the evals before and after you change `SKILL.md` or `checklist.md`, and include the before/after numbers in the PR.\n- Keep the scripts standard-library Python so the skill installs with no setup.\n\n
\n\n## License\n\n[MIT](LICENSE)\n"}