vibe-preflight
by globalmpc
65stars
0forks
Shell
Added 11/12/2026
Available after the catalog security scan passes.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
The deep catalog scan for this skill is still queued. Run an instant dependency check now instead.
AI Agentsagent-skillsai-codingclaude-codeclaude-code-skillcodexdockermpcopencodepre-deploy-checklistsecrets-detectionsecurity-auditvibe-coding
Maintainer of this skill?
Installation
# Add to your Claude Code skills
git clone https://github.com/globalmpc/vibe-preflightGetting Started
Guides for using ai agents skills like vibe-preflight.
- Caveman: Cut Claude Token Use by 65%How agent-side prompt compression works, when to use it, and when not to.
- How to Test an AI Skill: A Practical Guide to EvalsEvaluate skills with realistic fixtures, a baseline, and repeatable checks.
- Getting Started with AI SkillsFirst-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.
Compare with similar skills
See how vibe-preflight compares with popular alternatives.
vibe-preflight
A Claude Code skill that runs a pre-flight check on a vibe-coded app before it goes live — like a pilot's checklist before take-off — and explains what it finds in plain language.
It covers more than security: deployment with Docker, runaway costs, unfinished code and risky coding-agent settings, so you know whether the app is ready for real users.
Abridged from a real run on a small demo app (Next.js, Prisma, Postgres, OpenAI, Stripe, Docker Compose) written with typical vibe-coding mistakes. The full report it wrote: sample-report.md.
/vibe-preflight
It reads your project and writes two files to .vibe-preflight/ (git-ignored):
report.md— for you: what could go wrong, in plain words, and who fixes whatdetails.md— for the agent or a developer: every technical detail needed to fix it
Then it asks which problems you want fixed. It changes nothing until you say so.
What it checks
| Area | Examples |
|---|---|
| Security | keys in code or .env in git, secrets sent to the browser, one user reading another user's data, routes without login, SQL injection, unverified payment webhooks |
| Dependencies | packages that don't exist (hallucinated by the AI), known vulnerabilities, missing lockfile |
| Cost and abuse | paid AI/SMS/email APIs callable without login or limits, lists without pagination |
| Unfinished code | TODO stubs, fake data returned as real, hard-coded admin users, disabled auth checks |
| Deploy readiness | missing env docs, dangerous default secrets, dev mode in production, schema changes without migrations |
| Containers on a server | Docker Compose and Podman (including Quadlet): database ports open to the internet, host networking that exposes services, data without volumes, services that don't restart after a reboot |
| Hosting platforms | Vercel, Netlify, Cloudflare, Render, Railway, Fly.io: uploads saved to a disk that disappears, database connections running out, jobs that never run, public previews using real data |
| Dockerfile / Containerfile | .env copied into the image, dev server as CMD, running as root — and a multi-stage Dockerfile for Next.js, Vite SPAs, Node APIs and Python apps |
| Agent config | risky allow rules and hooks in .claude/settings*.json, tokens in .mcp.json |
Install
Works in Claude Code, Codex and OpenCode. Pick one:
Option 1 — with curl (no clone needed)
curl -fsSL https://raw.githubusercontent.com/globalmpc/vibe-preflight/main/install.sh | bash # all: Claude Code + Codex (OpenCode reads both folders)
curl -fsSL https://raw.githubusercontent.com/globalmpc/vibe-preflight/main/install.sh | bash -s -- --target codex # one harness: claude | codex | opencode | all
Option 2 — from a cloned repo
git clone https://github.com/globalmpc/vibe-preflight.git
cd vibe-preflight
bash install.sh # all: Claude Code + Codex (OpenCode reads both folders)
bash install.sh --target codex # one harness: claude | codex | opencode | all
Run it again to update. Start the skill with /vibe-preflight in Claude Code; in Codex type
$vibe-preflight (or /skills); in OpenCode ask for "vibe-preflight" and the agent loads it.
Use
/vibe-preflight # everything that applies
/vibe-preflight security # one area: security, dependencies, cost, unfinished, deploy, containers, platform, agent
/vibe-preflight apps/api # one folder
/vibe-preflight lang=id # reports in Bahasa Indonesia (any language: lang=es, lang=japanese …)
/vibe-preflight security lang=id # combine with an area or folder
The skill asks once before contacting package registries (to check that packages exist and have no known vulnerabilities). Only package names and versions are sent — never your code.
Limits
- The audit only reads files; it does not run your app, scan your server, or test live endpoints. Settings that live only in a hosting dashboard become questions for you.
- After you approve fixes, how much it tests depends on your agent setup. The skill only asks it to re-check each fix (and to build a Dockerfile it wrote, if Docker is available). Some setups also run tests, start containers or call the running app; others stop at reading the code. Check the reports for anything marked "not verified" and run it yourself.
- Kubernetes manifests and Helm charts are not checked yet.
- Findings come from an AI reading your code. Each one cites a file and line so you can check it; anything uncertain is listed separately as "Needs a human look".
- It does not replace a professional security review for apps that handle money or sensitive personal data.
License
MIT
Frequently Asked Questions
What is vibe-preflight?
vibe-preflight is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by globalmpc. It has 65 GitHub stars.
Is vibe-preflight safe to use?
vibe-preflight's catalog security scan is still queued. You can run an instant dependency and prompt-injection check now with the "Scan for vulnerabilities" button above.
How do I install vibe-preflight?
Clone the repository with "git clone https://github.com/globalmpc/vibe-preflight" and add it to your Claude Code skills directory (see the Installation section above).
What programming language is vibe-preflight written in?
vibe-preflight is primarily written in Shell. It is open-source under globalmpc on GitHub, so you can review or fork the full source.
Are there alternatives to vibe-preflight?
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh vibe-preflight against similar tools.
Comments (0)
to leave a comment.
No comments yet. Be the first to share your thoughts!
Related Skills
Reverse engineer anything with agents, from app behavior down to native binaries.
453,914
111,553
TypeScript
AI Agentsagent-skillsai
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
301,625
44,496
JavaScript
AI Agentsai-agentsanthropic
Skills for Real Engineers. Straight from my .agents directory.
250,518
21,171
Shell
AI Agents
An agentic skills framework & software development methodology that works.
234,966
20,863
Shell
AI Agentsaibrainstorming