vibeeval/project-audit
skills/project-audit/SKILL.md
Security scan, dead code detection, and code quality audit for any project
$ install --global
skillsauthnpx skillsauth add vibeeval/vibecosystem project-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 11, 2026, 5:40 AM296.6s1 file scanned
SKILL.md
- name:
- project-audit
- description:
- Security scan, dead code detection, and code quality audit for any project
- version:
- 1.0.0
- category:
- quality
- tags:
- [security, dead-code, audit, sast, quality]
Project Audit
Automated security + quality scan for any codebase. Generates a report, then optionally auto-fixes safe issues.
Usage
# Scan current directory
vibeco audit
# Scan specific path
vibeco audit /path/to/project
# Auto-fix safe issues (console.log removal)
vibeco audit --fix
# JSON output for CI integration
vibeco audit --json
What It Scans
Security (SAST)
- CRITICAL: eval(), exec(), execSync(), os.system(), subprocess, SQL injection patterns
- HIGH: innerHTML, dangerouslySetInnerHTML, document.write(), pickle.load(), hardcoded secrets
- MEDIUM: Sensitive data in console.log, MD5/SHA1 weak crypto
Code Quality
- Large files (>500 lines)
- TODO/FIXME/HACK/XXX count
- Excessive console.log (>3 per file)
Test Coverage
- Source file to test file ratio
- Test file detection (.test.ts, .spec.js, etc.)
Dependencies
- Lock file presence check
- Node engine version check
Output
Terminal Report
Color-coded report with grade (A+ to F):
- A+: Zero issues
- A-: Only MEDIUM issues
- B: Some MEDIUM issues
- C: HIGH issues present
- D: Many HIGH issues
- F: CRITICAL issues present
JSON Report
Saved to .vibeco-audit.json in project root. Contains all findings for programmatic processing.
Auto-Fix (--fix)
Currently auto-fixes:
- Removes console.log statements from files with >3 occurrences
Does NOT auto-fix (manual review required):
- Security issues (too risky for automation)
- Large file refactoring
- TODO/FIXME resolution
Workflow
1. vibeco audit -> Scan, generate report
2. Review report -> Understand issues
3. vibeco audit --fix -> Auto-fix safe issues
4. Manual fixes -> Address security findings
5. vibeco audit -> Re-scan to verify
Ignored Directories
node_modules, dist, .git, vendor, pycache, .next, build, coverage
Ignored in Security Scan
Test files (*.test.ts, *.spec.js, tests/, mocks/) are excluded from security scanning to avoid false positives.
Related Skills
vibeeval/workflow-router
development
VerifiedTrustedCommunity
Goal-based workflow orchestration - routes tasks to specialist agents based on user goals
500SKILL.mdUpdated Jun 11, 2026
vibeeval/wiring
tools
VerifiedTrustedCommunity
Wiring Verification
500SKILL.mdUpdated Jun 11, 2026
vibeeval/websocket-patterns
development
VerifiedTrustedCommunity
Connection management, room patterns, reconnection strategies, message buffering, and binary protocol design.
500SKILL.mdUpdated Jun 11, 2026
vibeeval/vp-engineering
testing
VerifiedTrustedCommunity
VP Engineering perspective - org design (team topologies), process improvement, cross-team dependencies, engineering culture, OKRs, incident management maturity, platform strategy, DX optimization, release management at scale
500SKILL.mdUpdated Jun 11, 2026