CtrlK
BlogDocsLog inGet started
Tessl Logo

vibe-code-auditor

Audit rapidly generated or AI-produced code for structural flaws, fragility, and production risks.

52

Quality

58%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills-claude/skills/vibe-code-auditor/SKILL.md

The canonical home for this skill is vibe-code-auditor in administrakt0r/AI-Agents-Safe-Coding-Skills

SKILL.md
Quality
Evals
Security

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-structured, highly actionable audit playbook with concrete heuristics, thresholds, and a complete report template. Its main weaknesses are redundancy between the pattern table and per-dimension quick checks, and a monolithic single-file layout with no progressive disclosure despite substantial content that could be split into references.

Suggestions

Dedupe the pattern-recognition table against dimensions 3 and 5 so each heuristic appears once; reference the table from the dimensions instead of restating it.

Move the full report template and scoring algorithm into a reference file (e.g. references/report-format.md) and keep SKILL.md as an overview that links to it, enabling one-level-deep progressive disclosure.

Collapse the Calibration and When-to-Use sections, which overlap, into a single concise scope-calibration block.

DimensionReasoningScore

Conciseness

The body is dense and avoids explaining concepts Claude already knows, but it is padded by redundancy: the pattern-recognition table (eval/exec, bare excepts, hardcoded creds) is repeated inside dimensions 3 and 5's quick checks, and the Calibration block restates the When-to-Use guidance, fitting 'mostly efficient but could be tightened.'

3 / 5

Actionability

It gives concrete executable guidance — specific grep strings ('f"SELECT', 'os.system'), numeric thresholds (>50 lines, >3 nesting, 5+ params), an exact scoring algorithm with point deductions, and a copy-paste report template — with only minor gaps versus fully runnable end-to-end code, matching 'mostly executable guidance; concrete commands with minor gaps.'

4 / 5

Workflow Clarity

The audit is clearly sequenced (Pre-Audit Checklist -> Quick Scan -> seven Dimensions -> Output Format -> Scoring) with checkpoints such as 'If any item is missing, state what is absent and proceed' and the 'unconfirmed - verify' security tag; the read-only nature means the destructive-cap does not apply, leaving only minor validation gaps.

4 / 5

Progressive Disclosure

There are no bundle files (references/scripts/assets absent) and no external references; the entire ~325-line body — including the full report template, scoring algorithm, and per-dimension checklists that could live in separate reference files — is inlined, fitting 'content that should be separate is inline' despite good header structure.

3 / 5

Total

14

/

20

Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does and targets a recognizable niche, but it omits any explicit 'when to use' trigger guidance and relies on a single action verb with less-common phrasing ('AI-produced' rather than 'AI-generated'/'vibe code'). It sits at the midpoint: clear and domain-specific, yet not comprehensive in actions or triggers.

Suggestions

Add an explicit 'Use when...' clause naming natural triggers, e.g. 'Use when reviewing AI-generated or vibe-coded code, or before productionizing a prototype.'

Swap 'AI-produced' for the more common 'AI-generated' and add 'vibe code' / 'AI-assisted code' as synonyms users actually say.

List 2-3 concrete actions (e.g. 'surfaces hidden technical debt, architectural weaknesses, and production risks') rather than a single 'Audit' verb.

DimensionReasoningScore

Specificity

The description names the domain ('rapidly generated or AI-produced code') and one concrete action ('Audit') plus three finding categories ('structural flaws, fragility, and production risks'), but relies on a single verb rather than listing several specific actions, matching the '1-2 concrete actions, not comprehensive' anchor.

3 / 5

Completeness

It has a clear 'what' (audit code for flaws/fragility/risks) but no 'Use when...' clause or equivalent trigger guidance, which per the guidelines caps completeness at 3; the 'when' is only weakly implied.

3 / 5

Trigger Term Quality

It includes relevant terms ('AI-produced code', 'production risks') but uses the less-common 'AI-produced' instead of the natural 'AI-generated code' and omits 'vibe code' entirely, leaving common variations and synonyms missing per the anchor.

3 / 5

Distinctiveness Conflict Risk

The AI/vibe-code auditing niche is mostly distinct, but the body itself lists 'security-audit' and 'test-driven-development' as related skills, indicating minor overlap risk with closely related skills rather than the minimal-conflict anchor of 5.

4 / 5

Total

13

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository
administrakt0r/AI-Agents-Safe-Coding-Skills
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.