Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pe-menezes/vibeflow --skill vibeflow-auditgit clone --depth 1 https://github.com/pe-menezes/vibeflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pe-menezes/vibeflow/vibeflow-audit)<a href="https://agentmods.dev/skills/pe-menezes/vibeflow/vibeflow-audit"><img src="https://agentmods.dev/badge/skills/pe-menezes/vibeflow/vibeflow-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pe-menezes/vibeflow/vibeflow-audit"><img src="https://agentmods.dev/badge/skills/pe-menezes/vibeflow/vibeflow-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.07780 |
| Opus 5.5 | $0.00050 | $0.03112 |
| Sonnet 5.5 | $0.00025 | $0.01556 |
| Haiku 4.5 | $0.00013 | $0.00778 |
Grade A, and why
vibeflow-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
| SEC108 | WARNING | a | dynamic exec (`eval`/`exec`/`system`/`popen`/`subprocess.call`/`child_process.exec`) | This is a copy
89% identical to audit — 79 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 535 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vibeflow: Audit
Audit recent work against its Definition of Done and project patterns.
Compares the current state of the code against the spec/DoD and verifies
the implementation follows conventions from .vibeflow/.
Usage: Provide the spec file path or feature name as input. Optional:
--package <path> audits from a review package already written,
--reaudit <round-commit> re-audits a fix round, --probes lets an audit
run by hand write its probe file and sabotage, and
--consolidate-hotfixes reclassifies hotfix docs.
Language
Detect the language of the user's input.
Write ALL output in that same language.
Technical terms in English are acceptable regardless of the detected language.
The report's machine-read labels stay literally in English in any output
language, because watch-round.mjs, stats and the smoke harness match them:
the header labels and their fixed values (Independence, Round, Stage,
final, Review package, Base, Verdict with pending, PASS, PARTIAL and
FAIL), the ### headings of the report, and the severity, cause and
closed-by-probe tokens of a finding line.
Independence and the loop kit
Record Independence: fresh session when this session did not do the work (a
subagent or a new session dispatched to audit), and Independence: same session when it runs where the work was done or the host has no fresh session
to offer. Independence: same session is recorded instead of refusing, and the
audit runs the same way; the reader weighs it, because a session that did not
see the work finds what the implementer missed.
The loop kit lives at .cursor/skills/vibeflow-implement/loop/. This
command uses two of its scripts, review-package.mjs and check-probes.mjs.
When the folder is missing, the kit is not installed:
npx setup-vibeflow@latest --cursor --force (setup-vibeflow 0.17.0 or newer)
installs it, and each step below says how the audit runs without it.
Steps
With --consolidate-hotfixes in the input, the round's target is
.vibeflow/hotfixes/ instead of a spec — jump to Consolidation mode below.
With --reaudit <round-commit>, follow Re-audit mode below.
A standalone audit (no loop briefing) writes the probe file and sabotages only
with --probes, so an audit run by hand writes only under .vibeflow/; a loop
part (briefing present) runs both as written (steps 6 and 7).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +271 lines · +39 tokens per session 30897d563ee1
- 1mo ago First seen · 264 lines · 86 tokens per session scan A fc41761af4ba
vibeflow-audit is a skill published in the GitHub repository pe-menezes/vibeflow (32 stars, last pushed today), licensed MIT. It adds 125 tokens to every session and 7,780 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). It is 89% identical to audit, differing in 79 lines, and is treated as a copy.
Other skills, from other repositories
quality-gates-evidence-contract
Use when producing or verifying the structured evidence log that attests quality gates (tests, build, mutation, commits, RED/GREEN integrity). Tech-agnostic schema. Loaded by software-engineer (writer) at COMMIT phase and by quality-gates-lens (reader) during review.
code-review
Review pull requests for repository fit, meaningful value, trustworthy provenance, differentiation, and maintainability in awesome-copilot.
discount-review
Inspect the discount policy fixture with a repeatable review checklist and helper script.
code-review
Reviews code for bugs, security issues, and best practices.
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
code-review
Review a diff against its acceptance criteria in four segments (convention adherence, bug scan, historical-context regressions, test-coverage gaps) as a NON-implementing agent. Findings are sorted by severity, each with file:line + a failure scenario. A planted defect must be caught; a clean diff must not be…