Vibe Audit

Vibe Audit

A 20-point audit for codebases that were shipped fast and need hardening. Work through every check in order. For each check: search the codebase, report findings with file paths and line numbers, then apply the fix (or propose it clearly if the change is large). Do not skip checks — report "none found" rather than omitting.

The 20 Checks

1. Duplicate utilities. Search for duplicate utility functions across the codebase. Consolidate all duplicates into a single shared utility file and update every import.

1. Secrets in config. Scan all committed config files for secrets or credentials. Flag anything that should have been an environment variable and move it.

1. Giant functions. Find any functions over 400 lines. Break them into smaller, single-responsibility functions with clear, descriptive names.

1. Giant components. Find any component over 200 lines. Split data fetching, business logic, and UI into separate layers.

1. Dead code. Scan for functions and variables that are defined but never called or referenced. Remove all dead code and flag anything that's unclear.

1. Silent catches. Find all empty or silent catch blocks. Add meaningful error logging and make sure failures are surfaced to the caller or the user.

1. API call states. Find every API call in the UI. Verify each one has a loading state, an error state, and prevents duplicate requests on re-render.

1. DB in route handlers. Check if any database queries are written directly inside route handlers. Extract all data access logic into a dedicated service or repository layer.

1. Sync I/O in handlers. Search for synchronous I/O operations inside request handlers. Replace with async equivalents so the event loop stays unblocked.

1. Unbounded lists. Check every endpoint that returns a list. Add pagination to any that fetch unbounded results.

1. Inconsistent response shapes. Audit all API endpoints for consistent response shapes. Standardize to one envelope structure and update every endpoint and client that doesn't match.

1. Floats for money. Search for any place floating point numbers are used for currency or financial values. Replace with integer arithmetic in cents and convert only at the display layer.

1. String dates. Find all dates stored as plain strings. Convert to ISO 8601 format or Unix timestamps and ensure timezone context is always preserved.

1. No retry on external calls. Find every external API call in the codebase. Add retry logic with exponential backoff to any that currently fail silently on a single error.

1. Stale comments. Find all code comments in the codebase. Verify each one still accurately describes the code it sits next to and delete or rewrite anything that no longer matches.

1. Unvalidated input. Find every place user input is accepted. Add validation and sanitization before it touches any business logic, database query, or API call.

1. Missing auth. Check every API route for missing authentication middleware. Add auth checks to any endpoint that should require a logged-in user.

1. Missing indexes. Check for missing indexes on columns used in WHERE clauses or joins. Add indexes to any high-frequency query columns.

1. N+1 queries. Find any place related data is fetched inside a loop. Replace with a batched query or join.

1. Duplicated SDK init. Search for third-party SDKs that are initialized in multiple places. Consolidate into a single shared instance.

How to Run

Go through the checks in order. For each: state the check, show what you searched, list findings (path:line), then fix or propose the fix. At the end, give a summary table of all 20 checks with status (fixed / proposed / none found). Ask the user before making sweeping changes that touch many files.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: nateslabach
• Source: nateslabach/skills
• License: MIT

Install and usage instructions live in the source repository linked above.