Borrowing it
Nothing to install: this file belongs to majiayu000/vibeguard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/majiayu000/vibeguard/main/.claude/commands/vibeguard/preflight.mdgit clone --depth 1 https://github.com/majiayu000/vibeguardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/majiayu000/vibeguard/preflight)<a href="https://agentmods.dev/commands/majiayu000/vibeguard/preflight"><img src="https://agentmods.dev/badge/commands/majiayu000/vibeguard/preflight.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.02157 |
| Opus 5 | $0.00013 | $0.01078 |
| Sonnet 5 | $0.00005 | $0.00431 |
| Haiku 4.5 | $0.00003 | $0.00216 |
Grade A, and why
VibeGuard: Preflight scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Core Concept
- Preventing problems before writing code is 10 times less expensive than detecting and fixing them after writing.
- What is output is a constraint set (a list of things that cannot be done), not a pile of information.
- The constraint set guides all subsequent coding, eliminating the need to make architectural decisions during the implementation phase
- Each constraint must be verifiable — either by writing a guard script or by writing a test assertion
Selection
Skip preflight for docs-only work, small bugs, focused tests, and explicit mechanical changes. Run it only for major architecture, migration, cross-system policy work, or when the user explicitly requests preflight.
No routing packet, runtime snapshot, or execution handoff is required. Ask a focused question only when a missing decision would materially change the constraints.
Trigger Condition
- Major cross-cutting architecture or migration work
- Added new entry point (binary/service/CLI subcommand)
- Modify the data layer (database, cache, file storage)
- Cross-module refactoring
Guardrails
- No code modification, only reading and analysis
- No guessing - Uncertainty is marked as
[UNCLEAR], and subsequently confirmed with AskUserQuestion - Show the constraint set before coding when the user requested a planning checkpoint
Steps
-
Identify project type and structure
- Detect languages/frameworks (Cargo.toml → Rust, package.json → TS/JS, pyproject.toml → Python)
- Recognize monorepo/workspace structure (workspace members/packages/apps)
- List all entry points (bin crate, main.ts, app.py, CLI commands)
- Output:
project overview(list of languages, frameworks, entry points)
-
Map shared resources
- Search all data path constructs (
data_dir,db_path,config_path,.join("xxx.db")) - Search all environment variables read (
env::var,process.env,os.environ) - Search all port/address bindings (
listen,bind,PORT) - Identify shared state (global singleton, shared database, message queue)
- Output:
Shared resource map(which resources are used by which entrances)
- Search all data path constructs (
-
Extract existing schema
- Error handling mode (Result vs unwrap, try-catch style)
- Type definition location (core/ vs each app defines it individually)
- Naming convention (snake_case/camelCase, prefix rules)
- Division of module responsibilities (which module is responsible for what)
- Output:
pattern list
3.5. Reference Implementation Search (Skeleton Projects)
- Before implementing new functions, first search whether there are similar implementations inside and outside the project for reference.
- Search within the project: Use Grep/Glob to search for keywords, function names, and pattern names to confirm that no existing implementations are missing
- Search outside project (only for large cross-cutting changes):
- Use WebSearch to search for "battle-tested" open source implementations (e.g.
"<feature> implementation" site:github.com) - Evaluate the suitability of candidate implementations (license compatibility, dependencies, maintenance activity)
- Not copy, but extract design decisions as input to constraint sets
- Use WebSearch to search for "battle-tested" open source implementations (e.g.
- Output:
Reference Implementation List[REF-01] In the project: src/core/xxx.ts already has similar XX logic and should be extended rather than newly created. [REF-02] Outside the project: The ZZ mode at github.com/xxx/yyy is worthy of reference (MIT, 1.2k stars, actively maintained) [REF-NONE] No reference implementation found, need to design from scratch - If an existing implementation is found in the project → Generate L1 constraint: "Extend [REF-XX] instead of creating a new one"
3.6. Directory semantic verification
- List all subdirectory names of the project (first level + second level), and compare the built-in semantic mapping table to determine the consistency of responsibilities:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 173 lines · 25 tokens per session scan A 31332ac8e50e
VibeGuard: Preflight is a command published in the GitHub repository majiayu000/vibeguard (41 stars, last pushed today), licensed MIT. It adds 25 tokens to every session and 2,157 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
simplify
The over-engineering review: five tags (delete, stdlib, native, yagni, shrink), a mandatory replacement per finding, and a real null result when there is nothing to cut.
test
Run the repository's actual test suite: every ecosystem's canonical runner — NOT run is never green.
git
The pre-finish status: branch, hygiene findings, message checks, workflow lint, template state.
init
Install the formatters this repository needs, with every command visible before it runs.
sonarqube
Analyze SonarCloud quality issues for a specific PR.
plan-start
5-phase planning command: PRD analysis, design review, technical decisions, dynamic research team, metrics. Produces a complete implementation plan + ADRs before any code is written.