VibeCoding-a-Website: Skill for Claude Code

.claude/skills/code-auditor/SKILL.md

code-auditor is a skill for Claude Code from mrhinkle/VibeCoding-a-Website. It costs 114 tokens per session (3,465 once invoked), scanned A, original, MIT.

A review of the JavaScript, HTML, and CSS that run a website, with checks for errors, failed requests, invalid markup, styling problems, and unsafe dependencies. It focuses on whether the site works correctly rather than mainly on speed.

In plain words
What is it for?
Use it to investigate browser-console errors, failed API calls, missing error handling, HTML validation issues, CSS problems, dependency vulnerabilities, and other website bugs.
Why use it?
Small code failures can break features, cause failed API requests, create browser warnings, or expose security problems. This helps locate those issues before users encounter them.

Skill for Claude Code

Written for Claude Code: installed under .claude/.

This is mrhinkle/VibeCoding-a-Website's own configuration. It tells Claude Code how to work on VibeCoding-a-Website itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything VibeCoding-a-Website configures →

Reuse

Borrowing it

Nothing to install: this file belongs to mrhinkle/VibeCoding-a-Website. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/mrhinkle/VibeCoding-a-Website/main/.claude/skills/code-auditor/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/mrhinkle/VibeCoding-a-Website

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-auditor

README.md
[![agentmods](https://agentmods.dev/badge/skills/mrhinkle/vibecoding-a-website/code-auditor/github.svg)](https://agentmods.dev/skills/mrhinkle/vibecoding-a-website/code-auditor)
Your own site
<a href="https://agentmods.dev/skills/mrhinkle/vibecoding-a-website/code-auditor"><img src="https://agentmods.dev/badge/skills/mrhinkle/vibecoding-a-website/code-auditor/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for code-auditor

Your own site · 80×15
<a href="https://agentmods.dev/skills/mrhinkle/vibecoding-a-website/code-auditor"><img src="https://agentmods.dev/badge/skills/mrhinkle/vibecoding-a-website/code-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 114 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,465 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00114 $0.03465
Opus 5.5 $0.00046 $0.01386
Sonnet 5.5 $0.00023 $0.00693
Haiku 4.5 $0.00011 $0.00347

Measured 2mo ago against content hash ddadacd25691, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

code-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/code-auditor/SKILL.md · 439 lines

How it starts

The opening of the file, as written. The whole thing — 439 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Code Auditor

The code-auditor skill ensures that the JavaScript, HTML, and CSS running your website is correct, robust, and follows best practices. While the performance-optimizer focuses on speed and file size, the code-auditor focuses on correctness: Does your code run without errors? Do your API integrations actually work? Is there proper error handling in place? Are your dependencies secure?

This skill is your "web programmer" — the person who makes sure everything runs without breaking.


JavaScript Audit

Console Error Detection

Scans your browser console for JavaScript errors with zero-error tolerance in production. Checks:

  • Uncaught errors and exceptions
  • Unhandled promise rejections (async operations that fail silently)
  • TypeError, ReferenceError, SyntaxError messages
  • Deprecation warnings that could break in future browser updates
  • Security warnings (mixed content, unsafe operations)

Why it matters: Users see broken functionality and get frustrated. Search engines penalize sites with errors.

API Call Failures

Tests all fetch() and XMLHttpRequest calls:

  • Failed requests (4xx, 5xx responses)
  • Network timeout issues
  • Malformed request headers or bodies
  • CORS errors when calling external APIs
  • Missing or invalid API keys blocking requests

Why it matters: If your contact form can't submit to Resend, or your analytics don't load, visitors won't know — they'll just see a broken site.

Memory Leaks & Event Listeners

Identifies JavaScript that keeps eating memory:

  • Event listeners never removed (onclick handlers that stack up)
  • Old data stored in variables but never cleaned up
  • DOM nodes kept in memory after being removed from the page
  • Timer intervals/timeouts that never clear

Why it matters: Your site gets slower and slower the longer users stay on it. On mobile, it can crash.

Dead Code & Unused Variables

Finds code that's not being used:

  • Functions defined but never called
  • Variables assigned but never read
  • Imports that don't get used
  • Conditional branches that will never execute

Read the full file on GitHub · 439 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 439 lines · 114 tokens per session scan A ddadacd25691

Subscribe to this mod's changes

code-auditor is a skill published in the GitHub repository mrhinkle/VibeCoding-a-Website (17 stars, last pushed 6mo ago), licensed MIT. It adds 114 tokens to every session and 3,465 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

code-auditor compared with skills from other repositories

code-auditor next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
code-auditormrhinkle/VibeCoding-a-WebsiteSkill176mo agoMITA114Claude Code
systematic-debuggingopen-metadata/OpenMetadataSkill16kyesterdayApache-2.0A37Claude Code
log-error-digestzebbern/claude-code-guideSkill4.7k3d agoMITA71Claude Code, Codex
cwv-optimizeradobe/skillsSkill319yesterdayApache-2.0A112Claude Code
ci-fixersipyourdrink-ltd/bernsteinSkill1.2kyesterdayApache-2.0A15Claude Code, Codex
incident-response-incident-responsermyndharis/antigravity-skillsSkill1.9k23d agoMITA36Claude Code
triaging-web-analytics-supportPostHog/posthogSkill41kyesterdaynoneA151Claude Code, Codex