Not in the top 1,000 by GitHub stars
haraldalder-vibemogger/vibe-audit
Проверь свой навайбкоженный проект на дыры до того, как это сделают боты 🩺
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/vibe-audit/SKILL.md
Week of Nov 2, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → a74e7cd02522
No earlier version was observed for comparison.
104GitHub stars
Not availablestars in 7 days
1skill in this repository
0commits in 30 days
Heat
Insufficient historyNot enough history yet to measure heat. It appears after a few days of data.
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- vibe-audit
skills/vibe-audit
How it works
vibe-audit
When your agent uses it
Аудит безопасности проекта - ищет захардкоженные ключи и секреты, .env в git, платные API в клиентском коде, CORS *, debug в проде, SQL-инъекции через f-строки, уязвимые зависимости, отсутствие rate limit, открытые AI-эндпоинты (cost bomb), роль из клиента, IDOR, дефолтные пароли, открытые Firebase-правила. Плюс live-проверка своего домена и чек-лист перед деплоем. Использовать когда пользователь просит - проверь безопасность, аудит, найди секреты/ключи в коде, security check, проверь перед деплоем/продом, безопасно ли выкладывать.
What it loads into context
Frontmatter
166 tokensAlways available to the agent
SKILL.md
1,092 tokensWhen the skill is activated
Reference documents
591 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Что делает
- Принципы (обязательно)
- Порядок работы
- Ограничения — говори о них честно
Scripts executed separately
scripts/audit.pyscripts/livecheck.py
Files
SKILL.mdcore5,862 bytesSKILL.mdcore5,862 bytesSKILL.mdcore5,862 byteschecklist.mddoc3,105 bytesscripts/audit.pyruns26,518 bytesscripts/livecheck.pyruns8,708 bytes
Read SKILL.md
# vibe-audit: аудит безопасности вайбкод-проекта
## Что делает
Детерминированный сканер + live-проверка своего сайта + чек-лист + твоя голова поверх.
Находит типовые дыры вайбкода и выдаёт отчёт «проблема → фикс» с главной цифрой находок.
## Принципы (обязательно)
1. **Только чтение и только свои ресурсы.** Ничего не менять. Live-проверку запускать
ТОЛЬКО против домена, которым владеет пользователь — скрипт сам спросит подтверждение.
2. **Секреты не цитировать.** Скрипты маскируют найденное; ты тоже никогда не выводишь
полное значение ключа.
3. **Формат «проблема → фикс».** Никогда не объясняй, как эксплуатировать находку,
не пиши пейлоады, не сканируй чужие домены — это не входит в задачу и не нужно.
4. Найден живой ключ → первым пунктом ответа «перевыпусти его сейчас».Skills included
- vibe-audit
Repository facts
- License
- MIT
- Created
- Aug 27, 2026
- Last pushed
- Sep 6, 2026
- Forks
- 13
- Open issues
- 0
- Project activity
- Slowing
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 6, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 2 notes
skills/vibe-audit/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/vibe-audit/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 1 dangerous shell commandin 1 file: vibe-audit/scripts/audit.py:154
- 15 network referencesin 2 files: vibe-audit/scripts/livecheck.py:11 vibe-audit/SKILL.md:39
- No hidden or obfuscated text
- No instruction overrides
- 2 executable scriptsin 2 files: vibe-audit/scripts/audit.py:1 vibe-audit/scripts/livecheck.py:1
- 14 references to secretsin 3 files: vibe-audit/scripts/audit.py:21 vibe-audit/SKILL.md:3 vibe-audit/scripts/livecheck.py:24
- No requests to vote in Hot
Show all 32 signals by file
skills/vibe-audit/SKILL.md
skills/vibe-audit/scripts/audit.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 21
[Credential-related source omitted] - Access to secretsline 75
[Credential-related source omitted] - Access to secretsline 76
[Credential-related source omitted] - Access to secretsline 116
[Credential-related source omitted] - Access to secretsline 129
[Credential-related source omitted] - Access to secretsline 150
[Credential-related source omitted] - Access to secretsline 152
[Credential-related source omitted] - Dangerous shell operationline 154
[Credential-related source omitted] - Access to secretsline 158
[Credential-related source omitted] - Access to secretsline 160
[Credential-related source omitted] - Access to secretsline 162
[Credential-related source omitted]
skills/vibe-audit/scripts/livecheck.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 11
Запуск: python3 livecheck.py https://мой-сайт.com - Network accessline 12
python3 livecheck.py https://мой-сайт.com - Network accessline 13
python3 livecheck.py https://мой-сайт.com --yes-i-own-this # пропустить вопрос - Access to secretsline 24
[Credential-related source omitted] - Network accessline 45
UA = "vibe-audit-livecheck/1.1 (+https://github.com/haraldalder-vibemogger/vibe-audit)" - Network accessline 48
def fetch(url, method="GET", timeout=10): - Network accessline 49
req = urllib.request.Request(url, method=method, headers={"User-Agent": UA}) - Network accessline 58
def main(): ap = argparse.ArgumentParser() ap.add_argument("url", help="URL ТВОЕГО сайта (https://...)") - Network accessline 59
ap = argparse.ArgumentParser() ap.add_argument("url", help="URL ТВОЕГО сайта (https://...)") ap.add_argument("--yes-i-own-this", action="store_true", help="пропустить подтверждение владения") - Network accessline 60
ap.add_argument("url", help="URL ТВОЕГО сайта (https://...)") - Network accessline 79
try: code, headers, _, jar, _final = fetch(url) - Network accessline 80
code, headers, _, jar, _final = fetch(url) - Network accessline 110
target = f"{url}/{path}" try: code, fhead, body, _, final_url = fetch(target) - Network accessline 111
try: code, fhead, body, _, final_url = fetch(target) if code != 200 or not body.strip(): - Network accessline 112
code, fhead, body, _, final_url = fetch(target)
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Declared and executed: 1 fact
- Contacts github.com, which SKILL.md, the README and the plugin manifest do not mentionvibe-audit/scripts/livecheck.py:45High confidence
Signal confidence: 32 facts
- Access to secrets in the frontmatter of the SKILL.mdvibe-audit/SKILL.md:3Low confidence
- Access to secrets in prose of the SKILL.mdvibe-audit/SKILL.md:27Low confidence
- Network access in code of the SKILL.mdvibe-audit/SKILL.md:39High confidence
- Access to secrets in prose of the SKILL.mdvibe-audit/SKILL.md:41Low confidence
- Executable script in code of a file that runsvibe-audit/scripts/audit.py:1High confidence
- Access to secrets in code of a file that runsvibe-audit/scripts/audit.py:21High confidence
- Access to secrets in code of a file that runsvibe-audit/scripts/audit.py:75High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuevibe-audit/scripts/audit.py:76Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuevibe-audit/scripts/audit.py:116Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuevibe-audit/scripts/audit.py:129Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuevibe-audit/scripts/audit.py:150Low confidence
- Access to secrets in code of a file that runsvibe-audit/scripts/audit.py:152High confidence
- Dangerous shell operation in code of a file that runsvibe-audit/scripts/audit.py:154High confidence
- Access to secrets in code of a file that runsvibe-audit/scripts/audit.py:158High confidence
- Access to secrets in code of a file that runsvibe-audit/scripts/audit.py:160High confidence
- Access to secrets in code of a file that runsvibe-audit/scripts/audit.py:162High confidence
- Executable script in code of a file that runsvibe-audit/scripts/livecheck.py:1High confidence
- Network access in prose of a file that runsvibe-audit/scripts/livecheck.py:11Low confidence
- Network access in prose of a file that runsvibe-audit/scripts/livecheck.py:12Low confidence
- Network access in prose of a file that runsvibe-audit/scripts/livecheck.py:13Low confidence
- Access to secrets in code of a file that runsvibe-audit/scripts/livecheck.py:24High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:45High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:48High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:49High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:58High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:59High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:60High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:79High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:80High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:110High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:111High confidence
- Network access in code of a file that runsvibe-audit/scripts/livecheck.py:112High confidence
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Compatible | Standard SKILL.md skills/vibe-audit/SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md skills/vibe-audit/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/vibe-audit/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/vibe-audit/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/vibe-audit/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/vibe-audit/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
