vibe-upgrade — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vibe-upgrade (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use when asked to "upgrade", "update vibestack", "get the latest skills", or after vibe-update-check reports a newer version is available.
The installed bin/vibe-* are symlinks back into the cloned repo; resolve one to find it. Fall back to common clone paths.
REPO=""
_T="$(readlink "${VIBESTACK_HOME:-$HOME/.vibestack}/bin/vibe-config" 2>/dev/null || true)"
[ -n "$_T" ] && REPO="$(cd "$(dirname "$_T")/.." 2>/dev/null && pwd || true)"
if [ -z "$REPO" ] || [ ! -f "$REPO/install" ]; then
for d in "$HOME/.claude/skills/vibestack" "$HOME/data/vibestack" "$HOME/vibestack" "$HOME/code/vibestack"; do
[ -f "$d/install" ] && [ -f "$d/VERSION" ] && REPO="$d" && break
done
fi
[ -n "$REPO" ] && echo "REPO: $REPO" || echo "REPO_NOT_FOUND"If REPO_NOT_FOUND: ask the user where they cloned vibestack, then continue with that path.
cd "$REPO"
BEFORE="$(cat VERSION 2>/dev/null)"
BR="$(git symbolic-ref --short HEAD 2>/dev/null || echo main)"
git fetch --quiet origin || { echo "FETCH_FAILED"; exit 0; }
if ! git pull --quiet --ff-only origin "$BR"; then
echo "PULL_BLOCKED — local changes or non-fast-forward. Stash/commit first, then re-run /vibe-upgrade. Not forcing."
exit 0
fi
AFTER="$(cat VERSION 2>/dev/null)"
./install --yes
echo "UPGRADED: $BEFORE -> $AFTER"BEFORE == AFTER: tell the user they were already on the latest.CHANGELOG.md and summarize the entries between the twoversions (newest first) in plain language — what they can now do.
skills.
Never force-push or hard-reset. A blocked pull is reported, not overridden.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.