vibe-init — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vibe-init (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reverse-engineers the vibe- framework scaffold from an existing codebase. Reads actual source files. Infers everything from code. Documents only what is observed. Produces a complete vibe/ folder that immediately unblocks all vibe- skills.
Run in agent mode (Claude Code / Cursor). Requires filesystem access. Single session — reads everything, generates everything, no staged checkpoints.
Code is the source of truth. Nothing is invented. If it's in ARCHITECTURE.md, it was observed in the codebase. If it's in CODEBASE.md, the file exists.
The past is untracked. The future is fully tracked. DECISIONS.md starts with one bootstrap entry dated today. Every decision made through vibe-* skills from this point forward gets logged. Prior decisions are acknowledged as unknown — not fabricated.
SPEC.md is provisional. It describes observed behaviour, not planned requirements. It is marked clearly. vibe-review will flag it until a human verifies it. This is honest — encoding bugs as requirements is worse than flagging uncertainty.
Before reading anything:
pwd
ls -laConfirm you are at the project root (the directory containing the source code). If not, stop and ask the user to navigate there first.
Check if vibe/ already exists:
ls -d vibe/ 2>/dev/null && echo "EXISTS" || echo "NOT FOUND"If vibe/ already exists:
"A vibe/ folder already exists in this project. Running vibe-init will overwrite it. Do you want to continue and regenerate from the current codebase state?"
Wait for explicit confirmation before proceeding.
Run this immediately after the pre-flight check — before any file reading.
find . -type f \
! -path '*/node_modules/*' ! -path '*/.git/*' \
! -path '*/dist/*' ! -path '*/build/*' \
! -path '*/__pycache__/*' ! -path '*/.next/*' \
! -path '*/coverage/*' ! -path '*/vendor/*' \
| wc -lClassify by file count and set reading budget:
| Size | Files | Stage 2 anchor reads | Stage 3 sample per folder |
|---|---|---|---|
| Small | < 50 | All anchor files | 3 files |
| Medium | 50–200 | All anchor files | 2 files |
| Large | 200–500 | Anchor files — max 25 total | 1 file |
| XL | 500+ | Anchor files — max 15 total | 1 file (critical folders only) |
For Large (200–500 files):
⚠️ Large codebase — sampled [N]/[total] filesFor XL (500+ files):
⚠️ XL codebase — [N] files. CODEBASE.md covers critical paths only.Run document: on specific modules to fill gaps progressively."
Store the size classification. Apply the budget throughout Stages 2 and 3.
Goal: Understand the full shape of the project without reading file contents. Fast. Covers everything.
find . -type f \
! -path '*/node_modules/*' \
! -path '*/.git/*' \
! -path '*/dist/*' \
! -path '*/build/*' \
! -path '*/__pycache__/*' \
! -path '*/.next/*' \
! -path '*/coverage/*' \
! -path '*/vendor/*' \
| sortAlso run:
find . -maxdepth 3 -type d \
! -path '*/node_modules/*' \
! -path '*/.git/*' \
! -path '*/dist/*' \
! -path '*/build/*' \
| sortFrom the topology, extract:
Tech stack indicators (file extensions, config filenames):
package.json → Node.js ecosystemrequirements.txt / pyproject.toml / Pipfile → Pythongo.mod → Gopubspec.yaml → Flutter/DartGemfile → Rubypom.xml / build.gradle → Java/Kotlincomposer.json → PHPFramework indicators (folder names, config files):
pages/ or app/ + next.config.* → Next.jssrc/routes/ + svelte.config.* → SvelteKitresources/views/ → Laravelapp/controllers/ → Railsmanage.py → Djangomain.py + routers/ → FastAPIStructural pattern (from folder names):
components/ + pages/ + hooks/ → feature-type frontendcontrollers/ + services/ + models/ → MVC backendfeatures/ or modules/ with sub-folders → feature-basedsrc/ → unstructured (note this explicitly)Database indicators:
prisma/schema.prisma → Prisma ORMmigrations/ or alembic/ → SQL migrations presentmodels/ with ORM patterns → ORM-based*.sql files → raw SQLLog your topology findings internally. Do not generate any output files yet.
Goal: Read the highest-signal files in full to confirm stack, entry points, and core patterns.
Read every file in this list that exists. Do not skip any that are present.
Package / dependency manifests (read in full):
package.jsonpackage-lock.json or yarn.lock (dependencies only — skip lockfile hashes)requirements.txt / pyproject.toml / Pipfilego.modpubspec.yamlGemfilecomposer.jsonConfiguration files (read in full):
.env.example or .env.sample (NEVER .env — never read secrets)docker-compose.yml / docker-compose.yamlDockerfile.eslintrc* / eslint.config.*tsconfig.jsonvite.config.* / next.config.* / nuxt.config.* / svelte.config.*tailwind.config.*jest.config.* / vitest.config.* / pytest.ini / pyproject.toml (test section)Entry points (read in full):
src/index.* / index.* (root level)src/main.* / main.*src/app.* / app.*src/server.* / server.*src/App.* (React/Vue root component)Route / controller files (read in full — max 5 files):
routes/, controllers/, api/, pages/api/, routers/Schema / model files (read in full — max 5 files):
prisma/schema.prismamodels/, schemas/, types/, db/src/types/index.*README (read in full if present):
README.md / README.rstNote: README may be outdated. Cross-check against actual code. Flag discrepancies.
Security rule — never read:
.envsecrets.*, credentials.*, *.key, *.pem, *.p12certs/ or keys/Goal: Confirm patterns by reading representative files from each major folder.
For each distinct folder type identified in Stage 1, read 2–3 files in full. Choose the largest or most centrally-named files — they tend to show the most patterns.
Standard sampling targets:
| Folder type | Files to read | What to extract |
|---|---|---|
components/ | 2 representative components | Props patterns, styling approach, composition style |
hooks/ or composables/ | 2 custom hooks | State management patterns, side effect handling |
services/ | 2 service files | API call patterns, error handling, data transformation |
utils/ or lib/ | 2 utility files | Helper patterns, shared logic |
middleware/ | All (usually small) | Auth patterns, request handling |
tests/ or __tests__/ | 2 test files | Testing patterns, coverage approach |
migrations/ | Most recent migration | Schema evolution approach |
Sampling budget — apply the size classification from large codebase protocol:
What to extract from each sampled file:
Before writing any files, internally consolidate everything from Stages 1–3:
Confirmed stack: [runtime] + [framework] + [database] + [key libraries]
Structural pattern: [feature-based / MVC / type-based / flat / mixed]
Naming conventions observed:
[camelCase / kebab-case / PascalCase / snake_case][camelCase / snake_case][PascalCase][camelCase / snake_case]State management: [local state only / Context / Zustand / Redux / Pinia / none observed]
Testing: [Jest / Vitest / pytest / none observed] — coverage: [present / absent]
Code quality tooling: [ESLint / Prettier / Ruff / Flake8 / none observed]
Key integration points observed: [external APIs, auth provider, payment system, storage, etc.]
Honest gaps — things not observed: List anything the code doesn't make clear. These become flagged unknowns in the docs.
Now write all files. Write them in this exact order — each file informs the next.
Read references/ARCHITECTURE_RETROFIT.md for the full template.
Fill from Stage 4 synthesis. Every section must be grounded in observed evidence. For each architectural decision, note: [Observed in: filename or pattern]
Key sections to populate:
Mark the file header:
> 📥 Generated by vibe-init on [date] from codebase analysis.
> Reflects patterns observed in the actual code — not planned decisions.
> Update this file as new patterns are deliberately introduced.Read references/CODEBASE_RETROFIT.md for the full template.
This is the most important file for unblocking vibe-add-feature and vibe-fix-bug. Be thorough. Every key file should be in here.
Sections to populate:
Mark each section that was partially sampled: > ⚠️ Partially sampled — [N] files read from [folder]. Update as more files are touched.
Read references/SPEC_RETROFIT.md for the full template.
Add this banner at the very top — it must be visible:
> ⚠️ PROVISIONAL SPEC — generated by vibe-init from observed code behaviour.
> This describes what the code DOES, not necessarily what it was INTENDED to do.
> Verify this spec before using vibe-review — incorrect specs will pass broken code.
> Last verified: [unverified — pending human review]Sections to populate from code observation:
Every feature listed must have a note: [Inferred from: file/route/component name]
Generate compressed map of SPEC.md. Follow same format as vibe-new-app. Add provisional banner at top.
# DECISIONS — [Project Name]
> Append-only. Every drift, scope change, tech choice — logged with full context.
> Onboarded via vibe-init on [date]. All decisions prior to this date are untracked.
## Decision types
- drift — deviated from ARCHITECTURE.md
- blocker-resolution — impossible; workaround found
- tech-choice — chose between valid approaches
- scope-change — added/removed via change: command
- discovery — unexpected finding affecting future tasks
## Format
### D-[ID] — [Short title]
- **Date**: · **Task**: [TASK-ID] · **Type**: [type]
- **What was planned**: · **What was done**: · **Why**:
- **Alternatives considered**: · **Impact on other tasks**:
- **Approved by**: human | agent-autonomous
---
### D-001 — Project onboarded via vibe-init
- **Date**: [today] · **Task**: vibe-init · **Type**: discovery
- **What was planned**: N/A — legacy project, no prior vibe context
- **What was done**: Generated vibe/ scaffold from codebase analysis.
Stack: [confirmed stack]. Pattern: [confirmed pattern].
Files read: [N] files across [N] directories.
- **Why**: Retrofitting vibe-* skills framework onto existing codebase.
- **Alternatives considered**: Manual documentation (rejected — too slow and error-prone)
- **Impact on other tasks**: All vibe-* skills now operational.
SPEC.md is provisional — verify before first vibe-review run.
- **Approved by**: human (triggered vibe-init)Generate a minimal but honest TASKS.md:
# TASKS — [Project Name]
> Onboarded via vibe-init on [date].
> This project was not built using the vibe-* framework.
> TASKS.md starts here. All future work tracked from this point forward.
## What we're working with
[2-3 sentences describing the project as inferred — stack, purpose, approximate scale]
## Active work
(nothing yet — add a feature with `feature:` or fix a bug with `bug:`)
## Completed
(prior work not tracked — project onboarded on [date])
## Phase gates
(not applicable — project pre-dates vibe-* framework)
## What's next
Run `review:` on the current codebase to establish a quality baseline.
Then use `feature:` or `bug:` to start tracking work normally.mkdir -p vibe/reviews
mkdir -p vibe/features
mkdir -p vibe/bugs
mkdir -p vibe/backlogCreate vibe/reviews/backlog.md:
# Review backlog
> Started on [date] via vibe-init.
> Run `review:` to populate this file with the first quality baseline.
## Outstanding P1 issues
(none yet — run review: to establish baseline)
## Outstanding P2 issues
(none yet)
## Resolved issues
(none yet)Read references/CLAUDE_RETROFIT.md for the full template.
Generate CLAUDE.md at project root.
Key differences from greenfield CLAUDE.md:
vibe/CODEBASE.md first (existing code, not scaffolded)Commands section must be populated from actual observed scripts:
# From package.json scripts / Makefile / observed patterns
dev: [actual dev command]
build: [actual build command]
test: [actual test command]
lint: [actual lint command]If a command wasn't observed, write: # Not observed during init — confirm with team
After all files are written, output a single consolidated report in the conversation:
✅ vibe-init complete — [Project Name]
GENERATED FILES
CLAUDE.md ← project root
vibe/ARCHITECTURE.md ← [N] patterns documented
vibe/CODEBASE.md ← [N] files mapped, [N] routes, [N] models
vibe/SPEC.md ← PROVISIONAL — [N] features inferred
vibe/SPEC_INDEX.md
vibe/DECISIONS.md ← D-001 bootstrap entry
vibe/TASKS.md
vibe/reviews/backlog.md
WHAT WAS READ
Stage 1: [N] files in topology scan
Stage 2: [N] anchor files read in full
Stage 3: [N] files sampled across [N] folder types
CONFIRMED
Stack: [e.g. Next.js 14 + TypeScript + Prisma + PostgreSQL]
Pattern: [e.g. Feature-based, MVC-ish]
Routes: [N] endpoints documented
Models: [N] data models documented
Commands: dev / build / test / lint [confirmed / partially confirmed]
FLAGGED UNKNOWNS
[List anything not determined — honest gaps]
⚠️ BEFORE RUNNING vibe-review:
Scan vibe/SPEC.md and verify the inferred features are correct.
Incorrect specs will cause review: to pass broken code.
When verified, remove the PROVISIONAL banner and update "Last verified" date.
WHAT WORKS NOW
✅ vibe-add-feature — CODEBASE.md and ARCHITECTURE.md ready
✅ vibe-fix-bug — CODEBASE.md and ARCHITECTURE.md ready
✅ vibe-review — works, but note PROVISIONAL SPEC warning above
✅ vibe-design — CODEBASE.md ready; DESIGN_SYSTEM.md generated on first design: run
✅ vibe-progress — TASKS.md ready (starts from today)
✅ vibe-change-spec — SPEC.md ready (verify first)
✅ vibe-graph — dependency graph built from CODEBASE.md
SUGGESTED FIRST STEP
review: ← establishes quality baseline on the existing codebaseAfter outputting the completion report, invoke vibe-graph: build.
This converts the CODEBASE.md just written into a queryable dependency graph. No extra file reads — the information was just extracted for CODEBASE.md. The graph enables vibe-fix-bug, vibe-test, and vibe-review to query relationships directly instead of loading the full CODEBASE.md.
vibe-graph: build complete
Files indexed from CODEBASE.md: [N]
Concepts mapped: [N]
Graph: vibe/graph/ (3 files generated)
Next update: automatic after next vibe-add-feature or vibe-fix-bugNever invent. If a pattern wasn't observed, it doesn't go in the docs. Use "not observed during init" over leaving a section blank.
Never read secrets. .env, *.key, *.pem, credentials.* — skip unconditionally.
Never overstate certainty. "Pattern observed in 3 of 4 service files" is more honest than "the project uses service-layer pattern."
Never generate PLAN.md. That's a greenfield document — phases and scaffolding don't apply to existing code. Its absence will not break any vibe-* skill.
Flag every gap explicitly. Unknowns in the docs are features, not failures. They tell the next agent exactly where to look when something doesn't make sense.
Large codebase caveat is mandatory. Any project with 200+ files must carry the partial sampling warning in ARCHITECTURE.md, CODEBASE.md, and the post-generation report.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.