A code review workflow that checks implementation quality, security, project standards, and frontend-backend API usage. A code review is a systematic inspection of changes before they are accepted or delivered.

Use it to inspect project documents and both codebases, verify API calls, review frontend and backend work, and record findings or required fixes.

It provides a documented check against the project's plans and rules, helping reveal defects, unsafe code, and integration problems early.

vibe-review — Skill for Claude Code by xushuodasd

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add xushuodasd/VIBE-Claude-Plugin --skill vibe-review

Clone the repo

git clone --depth 1 https://github.com/xushuodasd/VIBE-Claude-Plugin

Made for: Claude Code.

Or install vibe-claude-plugin, the plugin that ships this one along with the rest of its 25 skills, 1 command.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/xushuodasd/vibe-claude-plugin/vibe-review/github.svg)](https://agentmods.dev/skills/xushuodasd/vibe-claude-plugin/vibe-review)

Your own site

<a href="https://agentmods.dev/skills/xushuodasd/vibe-claude-plugin/vibe-review"><img src="https://agentmods.dev/badge/skills/xushuodasd/vibe-claude-plugin/vibe-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/xushuodasd/vibe-claude-plugin/vibe-review"><img src="https://agentmods.dev/badge/skills/xushuodasd/vibe-claude-plugin/vibe-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 22 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,604 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin 94% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00022	$0.02604
Opus 5	$0.00011	$0.01302
Sonnet 5	$0.00004	$0.00521
Haiku 4.5	$0.00002	$0.00260

Measured 11d ago against content hash 9306f916e1d6, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

vibe-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

94% identical to vibe-api-rules — 268 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

skills/vibe-review/SKILL.md · 214 lines

How it starts

The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.

代码检查工作流

1. 文档目的

规范代码检查流程，确保前端和后端代码按照开发计划文档进行开发，验证前端与后端的接口调用是否正常，保证项目质量和开发进度。

2. 工作流结构

一个完整的代码检查工作流应包含：

基本信息：名称、目标
前置步骤：产物检查、依赖项确认
执行步骤：详细的执行流程和顺序
执行建议：专业建议和注意事项
成功标准：任务完成的判定条件
失败处理：异常情况的应对措施
输出成果：明确的交付物和保存位置

3. 执行要求

严格按照步骤执行
与用户保持深度沟通
记录关键信息和结果
遇到异常时按失败处理机制执行
确保输出成果符合用户预期

4. 文档管理

执行后根据实际情况更新文档
进行版本管理，确保使用最新版本

5. 工作流程

前置步骤：准备工作

检查项目开发阶段：
- 查看./.vibe/stage.md文件，确认当前项目开发阶段
- 如果阶段未设定，提示用户先执行项目阶段开发计划工作流
检查开发计划文档：
- 确认./项目文档/开发计划/前端开发文档（前端开发计划）.md文件是否存在
- 确认./项目文档/开发计划/后端开发文档（后端开发计划）.md文件是否存在
- 确认./项目文档/开发计划/项目阶段开发计划总览.md文件是否存在
- 如果不存在，提示用户先执行项目阶段开发计划工作流
检查前端和后端目录：
- 确认./frontend目录是否存在
- 确认./backend目录是否存在
- 如果不存在，提示用户先执行前端开发工作流和后端开发工作流
检查前端和后端开发文档：
- 确认./frontend/doc目录下是否存在前端开发手册
- 确认./backend/doc目录下是否存在后端开发手册
- 如果不存在，提示用户先执行前端开发工作流和后端开发工作流

第一步：读取相关文档

读取开发计划文档：
- 读取./项目文档/开发计划/前端开发文档（前端开发计划）.md文件
- 读取./项目文档/开发计划/后端开发文档（后端开发计划）.md文件
- 读取./项目文档/开发计划/项目阶段开发计划总览.md文件
- 了解当前阶段的开发任务和要求
读取前端和后端开发手册：
- 读取./frontend/doc目录下的前端开发手册
- 读取./backend/doc目录下的后端开发手册
- 了解前端和后端的技术选型、API调用方式等
读取API设计规范文档：
- 读取./.vibe/workflows/api-rules.md文件
- 了解API设计规范和要求

第二步：前端代码检查

代码结构检查：
- 检查前端代码结构是否符合开发计划文档的要求
- 确认是否按照模块化原则进行开发
- 检查代码文件组织是否合理
功能实现检查：
- 检查当前阶段的前端功能是否按照开发计划文档实现
- 确认功能模块是否完整
- 检查功能实现是否符合需求
API调用检查：
- 检查前端代码中的API调用是否符合API设计规范
- 确认API调用的参数、路径、方法等是否正确
- 检查API调用的错误处理和异常捕获是否完善
代码质量检查：
- 检查前端代码结构是否清晰，逻辑是否流畅
- 检查代码是否符合前端编码规范和最佳实践
- 检查代码的可维护性和可扩展性
UI 质量检查（参照 vibe-ui-design 第 17 节 Pre-Delivery Checklist）：
- 视觉规范：颜色/间距/圆角/阴影是否全用 token，无硬编码
- 交互规范：hover/active/disabled 三态是否完整，hover 不改布局
- 可访问性：对比度≥4.5:1，键盘可达，焦点可见
- 响应式：375px/768px/1440px 三档布局不破
- 一致性：Button/Input/Card/Modal 是否全用组件库，无原生标签
测试验证：
- 对前端功能进行测试
- 验证功能是否符合需求
- 测试API调用是否正常

第三步：后端代码检查

代码结构检查：
- 检查后端代码结构是否符合开发计划文档的要求
- 确认是否按照模块化原则进行开发
- 检查代码文件组织是否合理

Read the full file on GitHub · 214 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 214 lines · 22 tokens per session scan A 9306f916e1d6

Subscribe to this mod's changes

vibe-review is a skill published in the GitHub repository xushuodasd/VIBE-Claude-Plugin (4 stars, last pushed 2mo ago), licensed MIT. It adds 22 tokens to every session and 2,604 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. It is 94% identical to vibe-api-rules, differing in 268 lines, and is treated as a copy.

Claude Code Code review Security ai-agent ai-workflow autonomous-coding claude-plugin coding-agent

council-review

Perform a rigorous Carmack Council code review. Use when explicitly asked to review code, do a "council review", "carmack review", or invoke /council-review. Carmack's philosophy chairs a council of domain experts — Troy Hunt (security), Martin Fowler (refactoring), Kent C. Dodds (frontend), Matteo Collina (Node.js)…

SamJHudson01/Carmack-Council · 166 tokens

vibe-review