bundled-skills/vibers-code-review/SKILL.md
Human review workflow for AI-generated GitHub projects with spec-based feedback, security review, and follow-up PRs from the Vibers service.
npx skillsauth add FrancoStino/opencode-skills-antigravity vibers-code-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
You push code. We review it against your spec, fix issues, and send a PR.
Use this skill when:
Go to your repo → Settings → Collaborators → Add marsiandeployer
Create .github/workflows/vibers.yml:
name: Vibers Code Review
on:
push:
branches: [main]
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 2
- uses: marsiandeployer/vibers-action@v1
with:
spec_url: 'https://docs.google.com/document/d/YOUR_SPEC_ID/edit'
telegram_contact: '@your_telegram'
| Parameter | What it does |
|-----------|-------------|
| spec_url | Link to your spec (Google Doc, Notion, etc.). Must be publicly accessible (or "anyone with the link can view"). Without access to spec, review is impossible. |
| review_scope | full (default), security, or spec-compliance |
| telegram_contact | Your Telegram — we'll message you when review is ready |
Add this block to your project's CLAUDE.md, .cursorrules, or AGENTS.md:
## Commit messages
Every commit MUST include a "How to test" section in the body:
- Live URL to open and verify the change
- Step-by-step what to click/check
- Test credentials if login is required
- Expected result for each step
Example:
feat: Add user registration form
How to test:
- Open https://myapp.vercel.app/register
- Fill in email/password, submit
- Check that confirmation email arrives
- Try submitting with invalid email — should show error
- Login: [email protected] / demo123
Without "How to test" the reviewer has to guess what to verify, and the review takes longer.
Done. Now every push triggers a notification. You'll get a PR with fixes, usually within 24 hours.
We check: spec compliance, security (OWASP top 10), AI hallucinations (fake APIs/imports), logic bugs, UI issues.
We don't check: code style (use ESLint/Prettier), performance benchmarks, full QA (use Playwright/Cypress).
marsiandeployer as a collaborator| Plan | Rate | Details | |------|------|---------| | Promo | $1/hour | Full review + PRs with fixes. We ask for honest feedback in return. | | Standard | $15/hour | Full review + security audit + priority turnaround. |
No subscriptions. No contracts. Pay per review.
Send feedback directly from your agent:
curl -X POST https://vibers.onout.org/feedback \
-H 'Content-Type: application/json' \
-d '{"message": "Your question or issue", "repo": "https://github.com/you/your-repo"}'
Both message and repo are required. Response: {"status": "accepted"}.
Contacts:
Do I need an API key? No. Add collaborator + action, that's it.
What languages? JS/TS, Python, React, Next.js, Django, Flask, and more. If it's on GitHub, we review it.
What if I disagree with a fix? Comment on the PR. We discuss and adjust.
Can I use this without GitHub? Yes — write to Telegram with your code and spec.
development
Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.
development
Passive income portfolio analysis — activate when user asks about dividend yields, Treasury rates, REIT income, monthly passive income goals, or portfolio yield optimization. Scans 4 asset classes, ranks by risk-adjusted return, and builds allocations targeting a specific monthly income.
devops
End-to-end production QA, build verification, and launch-readiness checklist for fullstack Next.js apps. Covers TypeScript, linting, tests, build, SEO tags, route regression, and sitemap validation.
development
Safe production cleanup and hardening for vibe-coded fullstack apps (Next.js, React, Node.js, etc.). Removes dead imports, unused files, and broken references without breaking routes or APIs.