# Vibe Pre Commit Audit

> Scans staged changes for secrets, debug statements, TODOs without references, and other common commit mistakes. Use before creating any commit.

- **Type:** Skill
- **Install:** `agentstack add skill-ash1794-vibe-engineering-pre-commit-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ash1794](https://agentstack.voostack.com/s/ash1794)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ash1794](https://github.com/ash1794)
- **Source:** https://github.com/ash1794/vibe-engineering/tree/master/plugins/vibe-engineering/skills/pre-commit-audit

## Install

```sh
agentstack add skill-ash1794-vibe-engineering-pre-commit-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# vibe-pre-commit-audit

Catch the easy mistakes before they enter history.

## When to Use This Skill

- Before creating a git commit
- When reviewing your own staged changes
- Before pushing to a shared branch

## When NOT to Use This Skill

- Commits to personal scratch branches
- When the user explicitly says to skip checks
- Auto-generated code commits (lock files, etc.)

## Checks

### 1. Secrets & Credentials
Scan for patterns:
- `API_KEY=`, `SECRET=`, `PASSWORD=`, `TOKEN=`
- AWS keys: `AKIA[0-9A-Z]{16}`
- Private keys: `-----BEGIN.*PRIVATE KEY-----`
- Connection strings with credentials
- `.env` files being staged

### 2. Debug Statements
- `console.log(`, `fmt.Println(`, `print(`, `debugger;`
- `// DEBUG`, `# DEBUG`, `/* DEBUG`
- `log.Debug` in non-debug code paths

### 3. TODOs Without References
- `TODO` without issue number: `TODO: fix this` (bad)
- `TODO(#123): fix this` (good)
- `FIXME`, `HACK`, `XXX` — flag all

### 4. Disabled Tests
- `t.Skip(`, `xit(`, `xdescribe(`, `@pytest.mark.skip`
- Commented-out test functions
- `//nolint` without justification

### 5. Large Files
- Files > 1MB
- Binary files (images, compiled assets)
- Lock files with excessive changes

### 6. Commented-Out Code
- Blocks of 3+ consecutive commented-out lines of code
- Not comments explaining code, but actual code that's commented out

## Output Format

### Pre-Commit Audit

**Status**: CLEAN / WARNINGS / BLOCKED

| Check | Status | Findings |
|-------|--------|----------|
| Secrets | ✓/✗ | X patterns found |
| Debug statements | ✓/✗ | X occurrences |
| TODOs | ✓/◐ | X without references |
| Disabled tests | ✓/✗ | X found |
| Large files | ✓/✗ | X over limit |
| Commented code | ✓/◐ | X blocks |

### Blocking Issues (must fix)
1. [Secret found in file.go:42]

### Warnings (should fix)
1. [TODO without reference in handler.ts:15]

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ash1794](https://github.com/ash1794)
- **Source:** [ash1794/vibe-engineering](https://github.com/ash1794/vibe-engineering)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-ash1794-vibe-engineering-pre-commit-audit
- Seller: https://agentstack.voostack.com/s/ash1794
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.