project-audit
Security scan, dead code detection, and code quality audit for any project
npx skills add vibeeval/vibecosystem --skill project-audit --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Project Audit Automated security + quality scan for any codebase. Generates a report, then optionally auto-fixes safe issues. ## Usage ```bash # Scan current directory vibeco audit # Scan specific path vibeco audit /path/to/project # Auto-fix safe issues (console.log removal) vibeco audit --fix # JSON output for CI integration vibeco audit --json ``` ## What It Scans ### Security (SAST) - **CRITICAL**: eval(), exec(), execSync(), os.system(), subprocess, SQL injection patterns - **HIGH**: innerHTML, dangerouslySetInnerHTML, document.write(), pickle.load(), hardcoded secrets - **MEDIUM**: Sensitive data in console.log, MD5/SHA1 weak crypto ### Code Quality - Large files (>500 lines) - TODO/FIXME/HACK/XXX count - Excessive console.log (>3 per file) ### Test Coverage - Source file to test file ratio - Test file detection (.test.ts, .spec.js, etc.) ### Dependencies - Lock file presence check - Node engine version check ## Output ### Terminal Report Color-coded report with grade (A+ to F): - A+: Zero issues - A-: Only MEDIUM issues - B: Some MEDIUM issues - C: HIGH issues present - D: Many HIGH issues - F: CRITICAL issues present ### JSON Report Saved to `.vibeco-audit.json` in projec
- Usage
- What It Scans
- Security (SAST)
- Code Quality
- Test Coverage
- Dependencies
- Output
- Terminal Report
- JSON Report
- Auto-Fix (--fix)
- Workflow
- Ignored Directories
- Ignored in Security Scan
Scan current directory vibeco audit Scan specific path vibeco audit /path/to/project Auto-fix safe issues (console.log removal) vibeco audit --fix JSON output for CI integration vibeco audit --json
What does the project-audit skill do?
Security scan, dead code detection, and code quality audit for any project
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill project-audit --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.