googlarz/vibe-coder-kit/vibe-check

vibe-check

Pre-push security and sanity check for solo vibecoders. Translates technical security findings into plain English so you know exactly what's at risk and what to do.

Overview

Before you push code to GitHub, run vibe-check. It scans for the problems that can get you hacked, expose your users' data, or rack up surprise cloud bills — and it tells you what each problem means in plain language.

vibe-check wraps vibe-safe if it's installed. If not, it runs its own basic scan. Either way, every finding comes with:

• What the problem is
• What happens to you or your users if someone exploits it
• One concrete step to fix it

Process

This skill runs a silent automated scan, then translates every finding into plain English with a verdict — no technical knowledge needed to read the output.

Step 1 — Detect what's available

Check for vibe-safe in this order:

1. ~/.claude/skills/vibe-safe/hooks/pre-commit (standard install path)
2. vibe-safe command on PATH
3. ./vibe-safe.sh in the project root

If none found, proceed to inline checks. To install vibe-safe:

git clone https://github.com/googlarz/vibe-safe ~/.claude/skills/vibe-safe

Step 2 — Run the scan

If vibe-safe is available: Run bash ~/.claude/skills/vibe-safe/hooks/pre-commit (or wherever it was found). Capture both the output and the exit code.

Parse the output:

• vibe-safe: all N checks passed -- clear (exit 0) → show as ✅ vibe-safe: all N checks passed — nothing to fix
• Lines matching vibe-safe: [description] (exit 0) → warnings; translate each through the guide below
• Any output + exit code 1 → STOP findings; translate each and mark the run as 🚨

For each vibe-safe: [description] line, strip the vibe-safe: prefix and match against the translation guide. The description IS the issue — your job is to add the RISK and FIX for it.

If vibe-safe is not available: Run the inline checks (see section below), then translate each finding.

Step 3 — .gitignore check (always)

On every scan, not just first-time:

• Does .gitignore exist?
• Are .env, node_modules, .DS_Store, *.log, *.sqlite, *.db listed in it?

A .gitignore entry can be accidentally removed in any commit. Check every time.

If no .vibe/.check-history file exists, this is a first-time scan — note it in the report.

Step 4 — Report findings

For each finding, output exactly:

ISSUE: [one plain sentence — what is wrong]
RISK:  [one plain sentence — what happens if exploited]
FIX:   [one concrete action]

Then give the verdict (see below).

Step 5 — Record history

After every scan (clean or not), create or update .vibe/.check-history with today's result. This marks the project as previously scanned and tracks trends over time.

mkdir -p .vibe

Create the directory if it doesn't exist — writing to .vibe/ will fail silently if the directory isn't there.

Append one line in this format:

[YYYY-MM-DD] — [verdict: ✅ Clean / ⚠️ Issues / 🚨 Critical] — [one-line summary]

Example: [2026-05-28] — ⚠️ Issues — missing .gitignore entry for .env, unpinned GitHub Action

Universal Scan Rules

Whether using vibe-safe or running greps manually — cap at 10 examples per finding, and apply the false positive rule: check each result in context before flagging. If any pattern returns more than 10 results: check the first 3 in context. If the first 3 are false positives, note "X pattern returned Y matches — none of the first 3 are real findings" and move on. Don't list all 50 matches — that's noise.

False positives are common. A password = getenv('PASSWORD') is safe — it's reading from an env variable, not hardcoding one. A password_reset_token variable name is not a hardcoded credential.

Translation Guide

This section is for Claude, not for you. If you're reading this as a user, skip to the Verdict section above — the scan runs silently and I'll translate every finding for you. You never need to read this table.

Claude: reference table — look up by keyword. Match the finding description from vibe-safe output and apply the plain-English explanation.

For anything not listed, apply the same format: explain what it is, what the real-world harm is, and what to do.

Inline Checks (when vibe-safe is not available)