Project Audit Agent Skill

by vibeeval

Security scan, dead code detection, and code quality audit for any project

558 tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

521

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/vibeeval/vibecosystem --skill project-audit

The instruction itself

14 sections, as written by the author

Project Audit

Automated security + quality scan for any codebase. Generates a report, then optionally auto-fixes safe issues.

Usage

# Scan current directory
vibeco audit

# Scan specific path
vibeco audit /path/to/project

# Auto-fix safe issues (console.log removal)
vibeco audit --fix

# JSON output for CI integration
vibeco audit --json

What It Scans

Security (SAST)

CRITICAL: eval(), exec(), execSync(), os.system(), subprocess, SQL injection patterns
HIGH: innerHTML, dangerouslySetInnerHTML, document.write(), pickle.load(), hardcoded secrets
MEDIUM: Sensitive data in console.log, MD5/SHA1 weak crypto

Code Quality

Large files (>500 lines)
TODO/FIXME/HACK/XXX count
Excessive console.log (>3 per file)

Test Coverage

Source file to test file ratio
Test file detection (.test.ts, .spec.js, etc.)

Dependencies

Lock file presence check
Node engine version check

Output

Terminal Report

Color-coded report with grade (A+ to F):

A+: Zero issues
A-: Only MEDIUM issues
B: Some MEDIUM issues
C: HIGH issues present
D: Many HIGH issues
F: CRITICAL issues present

JSON Report

Saved to .vibeco-audit.json in project root. Contains all findings for programmatic processing.

Auto-Fix (--fix)

Currently auto-fixes:

Removes console.log statements from files with >3 occurrences

Does NOT auto-fix (manual review required):

Security issues (too risky for automation)
Large file refactoring
TODO/FIXME resolution

Workflow

1. vibeco audit          -> Scan, generate report
2. Review report         -> Understand issues
3. vibeco audit --fix    -> Auto-fix safe issues
4. Manual fixes          -> Address security findings
5. vibeco audit          -> Re-scan to verify

Ignored Directories

node_modules, dist, .git, vendor, __pycache__, .next, build, coverage

Ignored in Security Scan

Test files (*.test.ts, *.spec.js, __tests__/, __mocks__/) are excluded from security scanning to avoid false positives.

Other skills for the same job

different authors, same section of the catalogue

Receiving Code Review

by ZhanlinCui

×7

Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation

2k tokens

Requesting Code Review

by ZhanlinCui

×6

Use when completing tasks, implementing major features, or before merging to verify work meets requirements

Execute git commit with conventional commit message analysis, intelligent staging, and message generation. Use when user asks to commit changes, create a git commit, or mentions "/commit". Supports: (1) Auto-detecting type and scope from changes, (2) Generating conventional commit messages from diff, (3) Interactive commit with optional type/scope/description overrides, (4) Intelligent file staging for logical grouping

Comprehensive GitHub code review with AI-powered swarm coordination

Behavioral guidelines to reduce common LLM coding mistakes. Use when writing, reviewing, or refactoring code to avoid overcomplication, make surgical changes, surface assumptions, and define verifiable success criteria.

Use this skill to review code. It supports both local changes (staged or working tree) and remote Pull Requests (by ID or URL). It focuses on correctness, maintainability, and adherence to project standards.

Refactor bloated AGENTS.md, CLAUDE.md, or similar agent instruction files to follow progressive disclosure principles. Splits monolithic files into organized, linked documentation.

Create high-quality git commits: review/stage intended changes, split into logical commits, and write clear commit messages (including Conventional Commits). Use when the user asks to commit, craft a commit message, stage changes, or split work into multiple commits.

2k tokens

How to use it

Copy the folder

Take vibeeval/project-audit from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.