{"id":49038877,"url":"https://github.com/FuzulsFriend/vibe-code-health-check","last_synced_at":"2026-05-05T19:00:54.983Z","repository":{"id":344751690,"uuid":"1178152515","full_name":"FuzulsFriend/vibe-code-health-check","owner":"FuzulsFriend","description":"Claude Code skill: grades your codebase A through F across 6 health dimensions with plain-English fixes — built for vibe coders and solo founders","archived":false,"fork":false,"pushed_at":"2026-03-15T19:13:00.000Z","size":592,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-03-16T17:40:52.919Z","etag":null,"topics":["claude-code","code-review","nextjs","owasp","security-audit","skill"],"latest_commit_sha":null,"homepage":null,"language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/FuzulsFriend.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-10T18:35:15.000Z","updated_at":"2026-03-15T19:13:03.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/FuzulsFriend/vibe-code-health-check","commit_stats":null,"previous_names":["fuzulsfriend/vibe-code-health-check"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/FuzulsFriend/vibe-code-health-check","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FuzulsFriend%2Fvibe-code-health-check","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FuzulsFriend%2Fvibe-code-health-check/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FuzulsFriend%2Fvibe-code-health-check/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FuzulsFriend%2Fvibe-code-health-check/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/FuzulsFriend","download_url":"https://codeload.github.com/FuzulsFriend/vibe-code-health-check/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FuzulsFriend%2Fvibe-code-health-check/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32663438,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-05T11:29:49.557Z","status":"ssl_error","status_checked_at":"2026-05-05T11:29:48.587Z","response_time":54,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["claude-code","code-review","nextjs","owasp","security-audit","skill"],"created_at":"2026-04-19T14:00:39.441Z","updated_at":"2026-05-05T19:00:54.977Z","avatar_url":"https://github.com/FuzulsFriend.png","language":"HTML","funding_links":[],"categories":["Clinical Skills \u0026 Knowledge Bases"],"sub_categories":[],"readme":"![Vibe Code Health Check](assets/banner.svg)\n\n# Vibe Code Health Check\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)\n[![SKILL.md](https://img.shields.io/badge/SKILL.md-open%20standard-green)](SKILL.md)\n\nGrade your code A to F. Get plain English fixes. No security background needed.\n\n---\n\n## You don't need to be a security expert to fix the issues\n\nThis skill reads your code and explains every finding in plain English. \"Your security header is set to report-only mode: it logs violations but doesn't block anything\" is something anyone can act on. So is \"Your database password is written directly in the code.\" You get a letter grade, a numbered list of issues, and exact file paths to fix them. No jargon. No guesswork.\n\n---\n\n## What it checks\n\n| Dimension | Weight | What it checks |\n|-----------|--------|----------------|\n| Security | 25% | Exposed secrets, unprotected routes, injection vulnerabilities |\n| Error Handling | 20% | Missing try/catch, unhandled promises, code that crashes silently |\n| Code Structure | 15% | File size, duplication, naming, organization |\n| Performance | 15% | Bundle size, waterfall fetches, unoptimized assets |\n| Deploy Readiness | 15% | Build pass/fail, environment config, .gitignore coverage |\n| UX Basics | 10% | Loading states, error messages, mobile responsiveness |\n\n---\n\n## Grading scale\n\n| Grade | Score | What it means |\n|-------|-------|---------------|\n| A | 90-100 | Production-ready. Ship it. |\n| B | 80-89 | Almost there. Fix the warnings and you're good. |\n| C | 70-79 | Functional but risky. Fix critical issues first. |\n| D | 60-69 | Significant problems. Not safe to deploy yet. |\n| F | Below 60 | Major security or stability issues. Do not ship. |\n\nSide projects get adjusted weights: security stays high, structure and deployment are weighted lighter.\n\n---\n\n## Install\n\n```bash\ngit clone https://github.com/FuzulsFriend/vibe-code-health-check ~/.claude/skills/vibe-code-health-check\n```\n\nOr copy `SKILL.md` directly into your `.claude/skills/` directory.\n\n---\n\n## Usage\n\nAsk Claude:\n\n```\nCheck my code\n```\n\n```\nIs my app ready to ship?\n```\n\n```\nAudit my project for security issues\n```\n\n---\n\n## What you get\n\n```\nVIBE CODE HEALTH CHECK\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nProject: my-saas-app\nStack:   Next.js 14, TypeScript, Supabase, Vercel\nFiles:   312 | Lines: 28,400 | Dependencies: 47\n\nOverall Grade: B (82/100)\n\nBREAKDOWN:\n  Security:         [████████░░]  78/100\n  Error Handling:   [████████░░]  80/100\n  Code Structure:   [███████░░░]  72/100\n  Performance:      [████████░░]  85/100\n  Deploy Readiness: [█████████░]  90/100\n  UX Basics:        [████████░░]  84/100\n\nCRITICAL (2) — Fix these before anyone uses your app:\n1. \"Your CSP header is in report-only mode: it logs violations but blocks nothing.\"\n   Fix: app/api/middleware.ts — change Content-Security-Policy-Report-Only to Content-Security-Policy\n\n2. \"Your Stripe webhook accepts requests without verifying the signature.\"\n   Fix: api/webhooks/stripe.ts — add Stripe.webhooks.constructEvent() verification\n\nWARNINGS (3) — Fix these soon:\n3. \"434 places in your code log debug info to the browser console.\"\n   Fix: Add ESLint rule: no-console\n```\n\nPlus a visual browser report with your grade badge, animated health bars, severity-color-coded findings with copy-to-clipboard file paths, a stats dashboard, and a step-by-step path to the next grade.\n\n---\n\n## Built on industry security and quality standards\n\nEvery finding in this skill traces back to a published standard maintained by the security or engineering community. That means the findings are objective, not opinions.\n\n1. **[OWASP Top 10](https://owasp.org/www-project-top-ten/)** - The Open Web Application Security Project publishes the 10 most critical web application security risks. This list is updated by security professionals worldwide and is the most widely referenced standard for web security.\n\n2. **[OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/)** - The Application Security Verification Standard is a framework of security requirements for designing, developing, and testing secure web applications. It gives this skill a structured checklist beyond just the top 10 risks.\n\n3. **[Core Web Vitals](https://web.dev/vitals/)** - Google's official performance metrics tied to real user experience. Poor scores hurt your SEO ranking and reduce conversion rates.\n\n4. **[TypeScript Strict Mode](https://www.typescriptlang.org/tsconfig#strict)** - Microsoft's strictest TypeScript configuration. Enabling it catches runtime errors at compile time, before users ever see them.\n\n5. **[React Best Practices](https://react.dev/)** - Error boundaries, key props, performance optimization, and component design patterns from the official React documentation. These prevent the most common React bugs in production.\n\n6. **[Next.js Best Practices](https://nextjs.org/docs)** - Image optimization, bundle splitting, server/client component boundaries, and deployment guidelines maintained by the Next.js team at Vercel.\n\n7. **[npm audit](https://docs.npmjs.com/cli/v10/commands/npm-audit)** - Automated vulnerability detection that checks your dependencies against the npm security advisory database. Catches known vulnerabilities in packages you didn't write.\n\n---\n\n## What it catches (from real audits)\n\n- API keys or secrets committed in source code\n- Admin routes with no authentication\n- SQL injection vulnerabilities\n- Unhandled promise rejections that crash silently\n- Missing error boundaries in React\n- CSP headers in report-only mode instead of enforced\n- Webhook endpoints that accept requests without signature verification\n- Test login endpoints deployed to production\n- Fragile import workarounds that break when someone \"cleans up\" the code\n- Files over 500 lines doing too many things at once\n- `SELECT *` queries that pull entire tables\n- 434 console.logs scattered through production code\n\n---\n\n## Stack-aware analysis\n\nThe skill detects your stack automatically and applies the right checks for it.\n\n- **Next.js / React** - Image optimization, server/client component boundaries, bundle size, React error boundaries\n- **Python / Flask / FastAPI** - Route authentication, input validation, debug mode in production\n- **Supabase** - Row Level Security policies, exposed service keys, unauthenticated queries\n- **Firebase** - Security rules coverage, client-side data exposure, unauthenticated reads\n\n---\n\n## What's included\n\n```\nvibe-code-health-check/\n├── SKILL.md                             # Main skill instructions\n├── assets/\n│   ├── banner.svg                       # Repository banner\n│   ├── preview.png                      # Report preview screenshot\n│   ├── report-template.md               # Text report template\n│   └── report-ui.html                   # Visual browser report\n└── references/\n    ├── scoring-rubric.md                # Exact scoring criteria per dimension\n    ├── security-patterns.md             # 8 vulnerability types with examples\n    ├── react-nextjs-checks.md           # React/Next.js specific checks\n    ├── python-flask-checks.md           # Python/Flask/FastAPI checks\n    ├── supabase-firebase-checks.md      # BaaS security gotchas and positive credit\n    ├── error-handling-rules.md          # Error handling patterns with code examples\n    ├── performance-rules.md             # 6 performance rules with examples\n    └── grade-thresholds.md              # What each grade (A-F) looks like\n```\n\n---\n\n## Works best with\n\n- **[Playwright CLI](https://github.com/lackeyjb/playwright-skill)** - Live browser testing catches issues static analysis misses\n- **Chrome DevTools MCP** - Console errors and real page speed from a running browser\n- **Agent Teams** - All 6 dimensions run in parallel for faster audits\n\nEnable Agent Teams:\n```bash\nexport CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1\n```\n\n---\n\n## License\n\nMIT\n\n---\n\n*Made by [Tomer E (FuzulsFriend)](https://github.com/FuzulsFriend)*\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FFuzulsFriend%2Fvibe-code-health-check","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FFuzulsFriend%2Fvibe-code-health-check","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FFuzulsFriend%2Fvibe-code-health-check/lists"}