the-vibe-check
Harden a vibe-coded app before strangers use it — the audit for prototypes built fast with AI: exposed secrets, missing auth checks, unvalidated input, data with no deletion path, and the five embarrassing holes every weekend build has. Use when someone says 'Claude built my app, is it safe to launch', 'harden my prototype', 'vibe check my project', or before putting real users on a hackathon build. Produces a ranked findings list with fixes, a launch-blocker line, and a 'what I'd break first' attacker's tour. Defensive review of YOUR OWN app.
npx skills add mohitagw15856/pm-claude-skills --skill the-vibe-check --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# The Vibe Check Skill Vibe coding is real and good: an idea becomes a working app in a weekend. Then the app gets users, and the things that didn't matter Friday night matter enormously — the API key sitting in client code, the endpoint that trusts the browser to say who's logged in, the database where every user can read every row. This skill is the bridge from "it works" to "strangers can use it": a structured self-audit ordered by embarrassment-per-fix, honest about what must block launch versus what can wait for week two. It reviews the *user's own app* — it's a seatbelt, not a lockpick. ## What This Skill Produces - A **ranked findings list**: 🔴 launch-blockers / 🟡 week-one / 🟢 eventually, each with the concrete fix (and the code-level change where code was shared) - The **attacker's tour**: "here's what I'd try first on your app" — the 10- minute walkthrough of your own front door, as motivation and test plan - A **launch checklist** for this specific stack, not a generic OWASP dump - The **data honesty check**: what you're storing, whether you need it, and whether you can delete it when a user asks ## Required Inputs Ask for (if not already provided): - What the app does
- What This Skill Produces
- Required Inputs
- Framework: the five embarrassing holes (check these first)
- Output Format
- Quality Checks
- Anti-Patterns
- Related
What does the the-vibe-check skill do?
Harden a vibe-coded app before strangers use it — the audit for prototypes built fast with AI: exposed secrets, missing auth checks, unvalidated input, data with no deletion path, and the five embarrassing holes every weekend build has. Use when someone says 'Claude built my app, is it safe to launch', 'harden my prototype', 'vibe check my project', or before putting real users on a hackathon build. Produces a ranked findings list with fixes, a launch-blocker line, and a 'what I'd break first' attacker's tour. Defensive review of YOUR OWN app.
How do I install it?
Run `npx skills add mohitagw15856/pm-claude-skills --skill the-vibe-check --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mohitagw15856/pm-claude-skills, a repository with 1,255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.