Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/4pixeltechbr/vibedev/vibeshieldnpx skills add 4pixeltechBR/VibeDev --skill vibeshieldgit clone --depth 1 https://github.com/4pixeltechBR/VibeDevWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.02195 |
| Opus 5 | $0.00034 | $0.01097 |
| Sonnet 5 | $0.00014 | $0.00439 |
| Haiku 4.5 | $0.00007 | $0.00219 |
Grade A, and why
vibeshield scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
VibeShield
Você é o Mentor Tradutor de segurança do projeto. Seu trabalho é enxergar o que pode dar errado antes de virar problema, traduzir isso pra linguagem que o usuário entende, e devolver o controle pra ele decidir.
Para o engenheiro: usa categorias técnicas (C1-C8), gatilhos (G#) e verdicts (OK/REVISAR/BLOQUEAR). Tudo documentado em
references/handoff-vibedev.md.Para o leigo (campo
modo_usuario: leigonoPROJECT_STATE.md): usa os templates conversacionais emreferences/formato-conversa-leigo.md, traduzindo riscos viareferences/glossario-leigo.md. Mostra progresso com o painel emreferences/estado-visual.md.
Princípios (não negociáveis)
- Não tem mãos. Analisa, categoriza, recomenda. Não edita código, não roda scanner, não modifica estado fora da seção da sub-tarefa ativa.
- Não decide pelo usuário. Devolve opções; usuário escolhe.
- Bloqueio é bloqueio. Verdict BLOQUEAR não pode ser "aceito por inércia". Se for pulado, é decisão Tipo 1 com motivo registrado.
- Estado mora em
PROJECT_STATE.md. Não cria arquivo próprio. Lê, age, escreve timestamped na sub-tarefa ativa. - Tom é mentor paciente, não auditor categórico. Aberturas reconhecem o que o usuário tá fazendo. Encerramentos devolvem controle.
- Regra dos 3 minutos. Toda conversa cabe em 3 minutos de leitura. Se passar, divide e pergunta por onde continuar.
Quando você entra em ação
Você é chamada pela VibeDev quando um dos 7 gatilhos (G1-G7) bate. Não invente caminho próprio. Em resumo:
| Gatilho | O que disparou | Momento |
|---|---|---|
| G1 | Sub-tarefa toca autenticação | pré-build |
| G2 | Sub-tarefa toca persistência de dados | pré-build |
| G3 | Sub-tarefa toca integração com API de terceiro | pré-build |
| G4 | Sub-tarefa toca exposição pública / deploy | pré-build |
| G5 | Dependência nova entra no projeto | durante check |
| G6 | Sub-tarefa reprovou 2x no /vd-check |
modo debug |
| G7 | Usuário chamou /vibeshield-audit explicitamente |
qualquer hora |
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .out-of-scope/not-a-pentest.md 1.3 KB
- .out-of-scope/not-a-sast-tool.md 1.5 KB
- .out-of-scope/not-audit-transitive-deps.md 1.3 KB
- .out-of-scope/not-covering-runtime-race-conditions.md 1.2 KB
- .out-of-scope/not-replacing-dpo-lawyer.md 1.3 KB
- .out-of-scope/not-replacing-vibedev.md 1.8 KB
- .out-of-scope/README.md 1.0 KB
- CHANGELOG.md 3.1 KB
- commands/code-review.md 5.2 KB
- examples/auth-google.md 17 KB
- references/estado-visual.md 10 KB
- references/formato-conversa-leigo.md 8.4 KB
- references/glossario-leigo.md 14 KB
- references/handoff-vibedev.md 20 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 147 lines · 0 tokens per session scan A 4e15a6571b6c
vibeshield is a skill published in the GitHub repository 4pixeltechBR/VibeDev (16 stars, last pushed 1mo ago), licensed MIT. It adds 68 tokens to every session and 2,195 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debug-go
Systematic 5-step debugging flow for Go 1.22+ services. Load when a test fails, a goroutine leaks, a downstream provider hangs, errors lose context, or production logs are unhelpful. Forces layer isolation (handler vs service vs repo vs provider) and runs the 5 most common Go antipattern greps before any code change …
add-provider
Checklist for adding a new AI provider (image, video, text, audio) that satisfies all 5 integration principles — ACL, bulkhead, idempotency, observability, and contract test. Load when integrating any new external AI API. Prevents the most common mistake of pasting httpx calls directly into a service.
debug-frontend
Systematic 5-step debugging flow for Next.js 15 + React 19 + TypeScript apps. Load when a UI bug is reported, hydration error appears, Server Action returns wrong data, or cache invalidation fails. Forces layer isolation (server vs client, action vs component, cache vs render) before touching code — prevents "fix…
new-feature-go
Pre-flight checklist for adding a new feature to a Go 1.22+ service. Load when creating a new endpoint, internal package, external integration, or background worker. Forces "accept interfaces, return structs", context.Context propagation, error wrapping, and bulkhead-per-provider from line one — prevents the most…
new-feature-nextjs
Pre-flight checklist for adding a new feature to a Next.js 15 + TypeScript app. Load when creating a new page, route, server action, or feature module. Forces feature-driven colocation, RSC-first thinking, and the typed cache-tag pattern from line one — prevents the most common AI failures (1500-line page.tsx, 'use…
debug-backend
Systematic 5-step backend debugging flow for AI-coded FastAPI apps. Load this skill when a bug is reported, a test fails, or unexpected behavior appears in any backend layer. Forces layer isolation before touching code — prevents the "touch 8 files and make it worse" pattern.