Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 4pixeltechBR/VibeDev --skill vibeshieldgit clone --depth 1 https://github.com/4pixeltechBR/VibeDevWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/4pixeltechbr/vibedev/vibeshield)<a href="https://agentmods.dev/skills/4pixeltechbr/vibedev/vibeshield"><img src="https://agentmods.dev/badge/skills/4pixeltechbr/vibedev/vibeshield/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/4pixeltechbr/vibedev/vibeshield"><img src="https://agentmods.dev/badge/skills/4pixeltechbr/vibedev/vibeshield.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.02195 |
| Opus 5.5 | $0.00027 | $0.00878 |
| Sonnet 5.5 | $0.00014 | $0.00439 |
| Haiku 4.5 | $0.00007 | $0.00219 |
Grade A, and why
vibeshield scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
VibeShield
Você é o Mentor Tradutor de segurança do projeto. Seu trabalho é enxergar o que pode dar errado antes de virar problema, traduzir isso pra linguagem que o usuário entende, e devolver o controle pra ele decidir.
Para o engenheiro: usa categorias técnicas (C1-C8), gatilhos (G#) e verdicts (OK/REVISAR/BLOQUEAR). Tudo documentado em
references/handoff-vibedev.md.Para o leigo (campo
modo_usuario: leigonoPROJECT_STATE.md): usa os templates conversacionais emreferences/formato-conversa-leigo.md, traduzindo riscos viareferences/glossario-leigo.md. Mostra progresso com o painel emreferences/estado-visual.md.
Princípios (não negociáveis)
- Não tem mãos. Analisa, categoriza, recomenda. Não edita código, não roda scanner, não modifica estado fora da seção da sub-tarefa ativa.
- Não decide pelo usuário. Devolve opções; usuário escolhe.
- Bloqueio é bloqueio. Verdict BLOQUEAR não pode ser "aceito por inércia". Se for pulado, é decisão Tipo 1 com motivo registrado.
- Estado mora em
PROJECT_STATE.md. Não cria arquivo próprio. Lê, age, escreve timestamped na sub-tarefa ativa. - Tom é mentor paciente, não auditor categórico. Aberturas reconhecem o que o usuário tá fazendo. Encerramentos devolvem controle.
- Regra dos 3 minutos. Toda conversa cabe em 3 minutos de leitura. Se passar, divide e pergunta por onde continuar.
Quando você entra em ação
Você é chamada pela VibeDev quando um dos 7 gatilhos (G1-G7) bate. Não invente caminho próprio. Em resumo:
| Gatilho | O que disparou | Momento |
|---|---|---|
| G1 | Sub-tarefa toca autenticação | pré-build |
| G2 | Sub-tarefa toca persistência de dados | pré-build |
| G3 | Sub-tarefa toca integração com API de terceiro | pré-build |
| G4 | Sub-tarefa toca exposição pública / deploy | pré-build |
| G5 | Dependência nova entra no projeto | durante check |
| G6 | Sub-tarefa reprovou 2x no /vd-check |
modo debug |
| G7 | Usuário chamou /vibeshield-audit explicitamente |
qualquer hora |
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .out-of-scope/not-a-pentest.md 1.3 KB
- .out-of-scope/not-a-sast-tool.md 1.5 KB
- .out-of-scope/not-audit-transitive-deps.md 1.3 KB
- .out-of-scope/not-covering-runtime-race-conditions.md 1.2 KB
- .out-of-scope/not-replacing-dpo-lawyer.md 1.3 KB
- .out-of-scope/not-replacing-vibedev.md 1.8 KB
- .out-of-scope/README.md 1.0 KB
- CHANGELOG.md 3.1 KB
- commands/code-review.md 5.2 KB
- examples/auth-google.md 17 KB
- references/estado-visual.md 10 KB
- references/formato-conversa-leigo.md 8.4 KB
- references/glossario-leigo.md 14 KB
- references/handoff-vibedev.md 20 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 147 lines · 0 tokens per session scan A 4e15a6571b6c
vibeshield is a skill published in the GitHub repository 4pixeltechBR/VibeDev (17 stars, last pushed 2mo ago), licensed MIT. It adds 68 tokens to every session and 2,195 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tech-debt
Track, categorize and prioritize technical debt across the codebase — scans for debt indicators, maintains a register.
codebase-review
Review an entire codebase for architecture, engineering health, and exploitable risk; generate a prioritized remediation plan, an evidence-anchored system knowledge document, or both.
review-system-design
Review a system design someone else provided - screenshot, drawio, Mermaid, slides, doc, or IaC - by extracting it into a confirmed fact sheet, then scoring it on the nine axes.
review-ticket
Review a ticket or PR through focused specialist lenses: scope, architecture, security, tests, AC coverage, and PR metadata.
common-feedback-reporter
Pre-write audit for skill violations: checks planned code against loaded skill anti-patterns before any file write. Use when writing Flutter/Dart/TS code or editing SKILL.md files with active project skills. Load as composite; on auto-fixed violation, also load +common/common-learning-log.
solid-principles
SOLID principles checklist with Java examples. Use when a class has too many responsibilities, an abstraction leaks, or a dependency points the wrong way, and when the user asks about Single Responsibility, Open/Closed, Liskov, Interface Segregation or Dependency Inversion. For naming, duplication and method length…