# Vibe Code Auditor

> Audit AI-generated or rapidly-prototyped code for structural flaws, hallucinated imports, fragility, and production risks before committing or handing off. Use when code was generated with AI assistance, evolved without deliberate architecture, or a prototype needs productionizing.

- Skill: `kumaran-is/vibe-code-auditor` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kumaran-is/vibe-code-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kumaran-is/vibe-code-auditor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: kumaran-is (https://skillmd.com/u/kumaran-is)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kumaran-is/vibe-code-auditor

---


## Iron Law

**NO FINDINGS WITHOUT CODE EVIDENCE — every issue must cite file and line number (or structural location for snippets). Do not speculate about code you have not read.**

# Vibe Code Auditor

## Overview

AI-generated and rapidly-prototyped code that "works" may contain hallucinated imports, missing library versions, architectural fragility, and production risks that are invisible during casual review.

This skill is the **pre-commit gate for AI-assisted code** — it runs before `code-reviewer` and `security-reviewer` to catch AI-specific artifacts first.

**Core distinction from `code-reviewer`:** `code-reviewer` assumes production-intent code. This skill assumes prototype/AI-generated code and specifically checks for hallucinated APIs and prototype-to-production gaps.

## When to Use

- Code was generated or heavily assisted by AI tools
- The system evolved without a deliberate architecture ("vibe coded")
- A prototype needs to be productionized
- Code works but feels fragile or inconsistent
- You suspect hallucinated imports or API mismatches
- Preparing a project for long-term maintenance or team handoff

## Pre-Audit Checklist

Before beginning, confirm:

- **Input received**: Source code or files are present
- **Scope defined**: snippet / single file / multi-file system
- **Context noted**: State assumptions if context is missing (e.g., "Assuming NestJS web API")

**Quick Scan (first 60 seconds):**
- Count files and lines of code
- Identify language(s) and framework(s)
- Spot obvious red flags: hardcoded secrets, bare excepts, TODOs, commented-out code
- Note entry points and data flow direction

**Pattern Recognition Shortcuts:**

| Pattern | Likely Issue | Quick Check |
|---------|-------------|-------------|
| `eval()`, `exec()`, `os.system()` | Security critical | Search for these strings |
| `except:` or `except Exception:` | Silent failures | Grep for bare excepts |
| `password`, `secret`, `key`, `token` in code | Hardcoded credentials | Search + check if literal string |
| `if DEBUG`, `debug=True` | Insecure defaults | Check config blocks |
| Functions >50 lines | Maintainability risk | Count lines per function |
| Nested `if` >3 levels | Complexity hotspot | Visual scan |
| No tests in repo | Quality gap | Look for `test_` / `*.spec.ts` files |
| Direct SQL string concat | SQL injection | Search for `f"SELECT` or `+ "SELECT` |
| HTTP client calls without timeout | Production risk | Check fetch/axios/requests calls |
| `while True` without break | Unbounded loop | Search for infinite loops |

## Audit Dimensions

Evaluate across all 7 dimensions. For each finding: dimension, title, location (file:line), severity, explanation, recommendation.

### 1. Architecture & Design
- Separation of concerns violations (business logic inside route handlers)
- God objects or monolithic modules
- Tight coupling with no abstraction boundary
- Missing or blurred system boundaries (DB queries scattered across layers)
- Circular dependencies or import cycles

### 2. Consistency & Maintainability
- Naming inconsistencies (`get_user` vs `fetchUser` vs `retrieveUserData`)
- Mixed paradigms without justification
- Copy-paste logic (3+ repetitions = extract)
- Magic numbers or strings without constants

### 3. Robustness & Error Handling
- Missing input validation on entry points
- Bare `except` or catch-all handlers that swallow failures silently
- Unhandled edge cases (empty collections, null/None, zero values)
- No retry logic for transient failures
- Missing timeouts on blocking operations

### 4. Production Risks
- Hardcoded configuration values (URLs, credentials, timeouts)
- Missing structured logging or observability hooks
- N+1 query patterns or unbounded loops
- Blocking I/O in async contexts
- No health checks or readiness endpoints

### 5. Security & Safety
- Unsanitized user input to databases, shells, or `eval`
- Credentials, API keys, or tokens in source code
- Insecure defaults (`DEBUG=True`, permissive CORS)
- SQL injection (string concatenation in queries)
- Missing authentication/authorization checks

### 6. Dead or Hallucinated Code *(AI-specific — unique to this skill)*
- Imports that do not exist in the declared dependencies
- References to APIs, methods, or fields that do not exist in the library version used
- Type annotations that contradict actual usage
- Comments describing behavior inconsistent with the code
- Unreachable code blocks (after `return`, `raise`, or `break` in all paths)
- Feature flags or conditionals that are always true/false

### 7. Technical Debt Hotspots
- Deep nesting (>3-4 levels)
- Boolean flag parameters controlling function behavior
- Functions with 5+ parameters without a config object
- Missing type hints for complex functions
- No documentation for public APIs

## Calibration by Code Size

| Input size | Focus |
|---|---|
| Snippet (<100 lines) | Security, robustness, obvious bugs only |
| Single file (100-500 lines) | Add architecture and maintainability |
| Multi-file system (500+ lines) | Full audit across all 7 dimensions |

## Output Format

Produce the audit report in this exact structure. If a section has no findings, write "None identified."

### Audit Report

**Input:** [file name(s) or "code snippet"]
**Assumptions:** [list any assumptions about context or environment]
**Quick Stats:** [X files, Y lines of code, Z language/framework]

#### Executive Summary

In 3-5 bullets:
```
- [CRITICAL/HIGH] Most severe issue
- [CRITICAL/HIGH] Second most severe issue
- [MEDIUM] Notable pattern
- Overall: Deployable as-is / Needs fixes / Requires major rework
```

#### Critical Issues (Must Fix Before Production)

For each issue:
```
[CRITICAL] Short descriptive title
Location: filename.ts, line 42
Dimension: Architecture / Security / Robustness / etc.
Problem: What is wrong and why it is dangerous.
Fix: Minimum change required.
Code Fix (if applicable):
  // Before: ...
  // After: ...
```

#### High-Risk Issues
Same format as Critical, tag `[HIGH]`.

#### Maintainability Problems
Same format, tag `[MEDIUM]` or `[LOW]`.

#### Production Readiness Score

```
Score: XX / 100
```

**Scoring algorithm:**
```
Start at 100
CRITICAL issue: -15 (security CRITICAL: -20)
HIGH issue: -8
MEDIUM issue: -3
Pervasive pattern (3+ similar issues): -5 additional
Floor: 0, Ceiling: 100
```

| Range | Meaning |
|-------|---------|
| 0-30 | Not deployable |
| 31-50 | High risk — significant rework required |
| 51-70 | Low-stakes / internal only with close monitoring |
| 71-85 | Production-viable with targeted fixes |
| 86-100 | Production-ready |

#### Refactoring Priorities

Top 3-5 changes in impact order:
```
1. [P1 - Blocker] Fix title — addresses [CRITICAL #1] — effort: S/M/L — prevents [specific failure]
2. [P2 - Blocker] Fix title — addresses [CRITICAL #2] — effort: S/M/L
3. [P3 - High] Fix title — addresses [HIGH #1] — effort: S/M/L
```

Effort: S = <1 day, M = 1-3 days, L = >3 days

## Behavior Rules

- Ground every finding in actual code. Do not speculate.
- Report file:line for every finding. For snippets, describe structurally (e.g., "inside `processPayment()`").
- Do not flag style preferences unless they cause ambiguity or bugs.
- Flag unconfirmed security issues as "unconfirmed — verify" rather than omitting or overstating.

## Post-Audit Next Steps

| Finding Type | Next Skill |
|---|---|
| Deep security vulnerabilities found | `security-reviewer` — full OWASP deep-dive |
| Architectural anti-patterns found | `architect-review` — distributed systems assessment |
| Tests missing across codebase | `test-driven-development` — Red-Green-Refactor cycle |
| Duplicate logic patterns found | `dedup-code-agent` — systematic deduplication |