Check my vibe
Skill aiskillstore/marketplace/skills/daanaagua/check-my-vibe
Security-audited skills for Claude, Codex & Claude Code. One-click install, quality verified.
npx -y skills add aiskillstore/marketplace --skill check-my-vibeAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
What its author says it does
Copied from the file, not written here
Use when a user wants to review the public security posture of an AI-generated, vibe-coded, or deployed website through an authorized passive scan, especially for security headers, exposed secrets, source maps, public files, and deployment mistakes.
SKILL.md
2.5 KB, as published. Nobody here has run it
Check My Vibe
Overview
Use Check My Vibe for an authorized, passive review of one public website. Run the real scan at https://checkmyvibeapp.com/; never invent results or replace it with an unprotected API call.
Workflow
- Get the target URL.
- Confirm authorization: the user must own the target or have the owner's permission. Stop if authorization is absent.
- Open
https://checkmyvibeapp.com/in the available browser. - Enter the target URL. The user must complete Turnstile; never bypass or solve it for them.
- Start the scan and wait for a completed or failed result.
- Read the score, coverage, limited or partial state, findings, evidence, remediation, limits, and errors.
- Report only findings supported by the scan evidence.
If no browser is available, give the user the Check My Vibe URL and ask them to paste the resulting report. Do not simulate the scan or call the protected endpoint directly.
Response Format
- Summary: Target, score, coverage, and whether the scan was partial or limited.
- Fix now: Critical and high findings, ordered by risk and dependencies.
- Fix next: Medium and low findings.
- Manual review: Review, not-tested, partial, or weak-evidence items.
- Top three actions: The highest-value next steps.
- Coverage limits: What this passive public-surface scan did not verify.
Boundaries
The scan does not prove a site is secure. It does not validate authenticated areas, database authorization, private repositories, business logic, complete dependency risk, or full penetration-test coverage. It does not log in, submit target forms, exploit vulnerabilities, or recursively crawl the site.
Never request passwords, API keys, cookies, or private source code. For verification failure, rate limiting, invalid targets, or safely unreachable pages, explain the error and use the site's normal retry path without changing identity or bypassing controls.
Common Mistakes
- Treating a public URL as permission to scan it.
- Claiming that a clean report means the site is secure.
- Guessing code locations or vulnerabilities not present in the evidence.
- Bypassing Turnstile, same-origin checks, rate limits, or URL safety rules.