Maintainer of this skill?
Automated security scan — not a certification.
A curated, battle-tested AI-coding toolkit: Claude Code plugins, subagent orchestration, quality gates, and ready-to-copy prompts, extracted from real production use.
# Add to your Claude Code skills
git clone https://github.com/soumatheusgomes/vibe-coding-toolkitGuides for using ai agents skills like vibe-coding-toolkit.
Last scanned: 9/4/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-09-04T08:34:09.517Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how vibe-coding-toolkit compares with popular alternatives.
vibe-coding-toolkit is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by soumatheusgomes. A curated, battle-tested AI-coding toolkit: Claude Code plugins, subagent orchestration, quality gates, and ready-to-copy prompts, extracted from real production use. It has 1,523 GitHub stars.
Yes. vibe-coding-toolkit passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/soumatheusgomes/vibe-coding-toolkit" and add it to your Claude Code skills directory (see the Installation section above).
vibe-coding-toolkit is primarily written in JavaScript. It is open-source under soumatheusgomes on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh vibe-coding-toolkit against similar tools.
No comments yet. Be the first to share your thoughts!
30 days in the Featured rail · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
English · Português (Brasil) · Español
Set up your machine. Bootstrap or upgrade your projects.
A toolkit of documentation, prompts, and templates with two functions: configure machines and configure individual projects. Build with AI agents: prepare your machine, start an application, improve an existing project, and maintain context and quality throughout the work.
You describe the goal. The agent inspects the environment, organizes decisions, configures applicable components, and verifies the result. The code stays in your project; this repository holds the recipe.
| Your situation | Path | What you get |
|---|---|---|
| I have an idea | Start a Next.js project · Prompt 11 | Defined product, official foundation, documentation, skills, and checks |
| I already have a project | Configure or update the foundation | Diagnosis, brainstorming, harness, tools, and verified improvements |
| I need to prepare my machine | Environment setup · Prompt 10 | Runtime, agents, global integrations, backups, and manifest |
| I need to solve a specific problem | Modular installation · Prompts | Lint, refactoring, review, context, or a specific tool |
On this page: Foundation · Agents · Knowledge · Quality · Prompts · Documentation · Community.
The agent must be able to read files, edit, and execute commands. The guides cover Claude Code and Codex separately; other clients can follow the agreements with equivalent capabilities. A conversation without environment access explains the process but does not prove installations or tests.
Setup starts with what exists: product, files, runtime, package manager, instructions, and available tools. New projects receive a coherent foundation; existing projects receive adoption compatible with their contracts.
Open the agent in the destination directory and paste. Replace the second line with your product description:
Read https://raw.githubusercontent.com/soumatheusgomes/vibe-coding-toolkit/main/docs/prompts/11-next-project-bootstrap.md and execute setup in this directory.
Project: [name, problem, audience, main flows, and constraints].
Example: “CRM for small real estate agencies. Agents record contacts, deals, and tasks; managers track the pipeline by team. English interface, MVP focused on registration and tracking opportunities.”
| Delivery area | Contents |
|---|---|
| Product | PRODUCT.md: problem, audience, MVP, constraints, assumptions, and acceptance criteria |
| Application | Official Next.js foundation, App Router, TypeScript, Tailwind, and ESLint |
| Server and data | Drizzle/PostgreSQL for new persistence, Zod, Pino, and server boundaries |
| Tests and quality | Vitest, local rules, canonical scripts, and foundation validation |
| Agents | Shared instructions, client-specific integration, and local Vercel skills |
| Documentation | Four root files and five documents in docs/, with sources and evidence |
The bootstrap ends with a configured foundation and the next MVP task identified. Authentication, services, and features depend on the product. An application without persistence may omit the database with a reason. The defaults are reviewed against current sources during execution.
Open the agent at the application root and paste:
Read https://raw.githubusercontent.com/soumatheusgomes/vibe-coding-toolkit/main/docs/prompts/12-existing-project-setup.md and execute the entire “Prompt” section block in this project, starting with brainstorming.
The prompt supports a codebase without the toolkit, partial adoption, or an older configuration. Work follows this path:
Rerunning the prompt is part of maintenance. It checks the toolkit revision and current documentation, preserves customizations, and avoids duplicate instructions, skills, hooks, or MCP servers. Existing stack, database, and contracts are preserved; incompatible migrations require their own decision.
Read https://raw.githubusercontent.com/soumatheusgomes/vibe-coding-toolkit/main/docs/prompts/10-development-environment-setup.md and execute the entire “Prompt” section block on this computer.
Global setup handles system tools, Node.js, Docker, agents, plugins, and integrations. It records versions, scopes, backups, validations, and required interventions. Project setup reuses this environment.
Paste these texts into a conversation with an agent that has terminal access. Remote shortcuts use the version published on
main; in an unpublished checkout, use the local file. No setup automatically publishes your application.
Understand → design → plan when needed → implement → verify → review. Each stage makes the result more predictable. The process follows the request's size and current authorization.
| Role | Tools and agreements | When to use |
|---|---|---|
| Understand and decide | Superpowers | Brainstorming, proportional design, planning, diagnosis, and verification |
| Build within scope | Ponytail full | Reuse what exists and deliver the smallest complete change |
| Communicate clearly | Caveman | Concise responses; normal wording for code, documentation, and commits |
| Delegate responsibly | Subagents and waves | Isolatable context, useful specialization, and independent tasks |
| Reduce repetitive output | RTK | Supported commands, preserving access to original output |
| Configure each client | Codex · Claude playbook | Instructions, skill discovery, MCP servers, and hooks in the correct format |
With authorized model selection, the LLM chooses among models and effort levels actually available. Search, inventory, and mechanical changes favor lightweight capability; ambiguous decisions, security, data, and critical review receive enough capability for the risk.
The existing-project prompt authorizes this selection within the current client and authentication, respecting explicit restrictions. Without that policy, preserve the session model. Tool availability does not author