██╗   ██╗██╗██████╗ ███████╗      ███████╗██╗██╗  ██╗
██║   ██║██║██╔══██╗██╔════╝      ██╔════╝██║╚██╗██╔╝
██║   ██║██║██████╔╝█████╗  █████╗█████╗  ██║ ╚███╔╝ 
╚██╗ ██╔╝██║██╔══██╗██╔══╝  ╚════╝██╔══╝  ██║ ██╔██╗ 
 ╚████╔╝ ██║██████╔╝███████╗      ██║     ██║██╔╝ ██╗
  ╚═══╝  ╚═╝╚═════╝ ╚══════╝      ╚═╝     ╚═╝╚═╝  ╚═╝

Surgical repair for AI-generated spaghetti code

You vibe-coded it in a weekend. Now it's 3 AM. Production is down. Secrets are exposed. Tests don't exist. You don't even remember what half this code does.

vibe-fix was built for this exact moment.

---

🤯 The Problem Nobody Talks About

Everyone's shipping with AI. Cursor. Claude Code. Codex. Gemini CLI. Antigravity.

The code looks fine. It runs fine. Until it doesn't.

What AI gives you ✨ # Here's a user registration endpoint! @app.post("/register") async def register(data: dict): api_key = "sk-proj-abc123secretkey" # 🔴 EXPOSED user = db.execute( f"INSERT INTO users VALUES ('{data['email']}')" # 🔴 SQL INJECTION ) return {"ok": True} # 🟠 No error handling # 🟠 No validation # 🟡 No types # 🟢 No tests, no docs

What vibe-fix gives you 🔧 VIBE-FIX AUDIT REPORT ═══════════════════════════════ Project : my-startup Risk : 🔴 CRITICAL Issues : 6 total 🔴 CRITICAL (2) [app.py:3] Hardcoded API key detected ✔ Fix: Move to os.getenv("OPENAI_API_KEY") [app.py:5] SQL injection via f-string ✔ Fix: Use parameterized queries 🟠 HIGH (2) ... 🟡 MEDIUM (1) ... 🟢 LOW (1) ... ═══════════════════════════════

---

⚡ What vibe-fix Does

Phase	What Happens
🔍 DIAGNOSE	Scans your codebase for 30 AI-generated antipatterns across 4 severity tiers
📋 REPORT	Outputs a prioritized triage report: exact file, line, issue, and fix
🔧 FIX	Surgically repairs issues one tier at a time — never rewrites what works
🛡️ HARDEN	Adds .env.example, error boundaries, logging, README, .gitignore

What vibe-fix catches:

• 🔴 Hardcoded secrets (API keys, passwords, tokens in source)
• 🔴 SQL injection (f-strings, string concat in queries)
• 🔴 Missing auth on sensitive routes
• 🟠 Silent error swallowing (empty catch blocks)
• 🟠 God functions (1 function doing 10 things)
• 🟠 No input validation (user data accepted raw)
• 🟡 Missing loading/error states in React
• 🟡 Infinite re-render loops (useEffect antipatterns)
• 🟡 Magic numbers everywhere
• 🟢 No README, no .env.example, no .gitignore

Full catalog: references/vibe-code-patterns.md

---

🚀 Install

Option 1 — npx (Claude Code / Cursor / Codex / Gemini CLI / Antigravity)

npx skills add NISTALTALSON/vibe-fix

.

Option 2 — Manual

# Clone into your skills directory
git clone https://github.com/NISTALTALSON/vibe-fix ~/.claude/skills/vibe-fix

# Or project-local
git clone https://github.com/NISTALTALSON/vibe-fix .claude/skills/vibe-fix

Option 3 — Run the scanner standalone (no AI agent needed)

# Python projects
python ~/.claude/skills/vibe-fix/scripts/audit.py ./my-project

# Node.js projects
node ~/.claude/skills/vibe-fix/scripts/audit.js ./my-project

# Export JSON report
python scripts/audit.py . --json > report.json

---

🎯 Usage

Once installed, just describe your problem naturally:

"My codebase is a mess, fix it"
"Clean up this AI-generated code"
"Audit my project for security issues"
"My vibe code is broken, help"
"Fix my spaghetti"

vibe-fix triggers automatically. No slash command needed.

Or use the audit scripts directly:

# Python — full audit
python scripts/audit.py /path/to/project

# Node.js — full audit  
node scripts/audit.js /path/to/project

# Auto-generate .env.example from found secrets
python scripts/audit.py . --fix-secrets

# JSON output (for CI/CD pipelines)
node scripts/audit.js . --json | jq '.issues[] | select(.severity == "CRITICAL")'

---

📸 Example Session

You: "My codebase is a disaster, it's all AI-generated and I think there are security issues"

Claude: Running vibe-fix audit...

VIBE-FIX AUDIT REPORT
═══════════════════════════════════════════════════
Project  : findmypg-api
Files    : 23 total, 8 with issues
Risk     : 🔴 CRITICAL
Issues   : 14 total

🔴 CRITICAL (3)
  [src/config.js:4]
  > const stripeKey = "sk_live_xxxxxxxxxxx"
  ↳ Hardcoded Stripe secret key in source
  ✔ Move to process.env.STRIPE_SECRET_KEY

  [src/routes/users.js:18]
  > db.query(`SELECT * FROM users WHERE email = '${email}'`)
  ↳ SQL injection via string interpolation
  ✔ Use parameterized: db.query('... WHERE email = $1', [email])

  [src/routes/admin.js:3]
  > app.get('/admin/export', async (req, res) => {
  ↳ Sensitive route with no auth middleware
  ✔ Add requireAuth middleware before handler

🟠 HIGH (4 issues) ...
🟡 MEDIUM (5 issues) ...
🟢 LOW (2 issues) ...

═══════════════════════════════════════════════════
Which tier would you like me to fix first?.

---

🌐 Works Everywhere

vibe-fix uses the universal SKILL.md format. One install, every AI agent:

Platform	Status
Claude Code	✅ Full support
Cursor	✅ Full support
Codex CLI	✅ Full support
Gemini CLI	✅ Full support
Antigravity IDE	✅ Full support
Amp CLI	✅ Full support
OpenCode	✅ Full support

---

📁 Structure

vibe-fix/
├── SKILL.md                    ← Main skill (loaded by AI agents)
├── scripts/
│   ├── audit.py                ← Python project scanner
│   └── audit.js                ← Node.js project scanner
└── references/
    ├── vibe-code-patterns.md   ← Catalog of 30 AI antipatterns
    └── fix-templates.md        ← Copy-paste fix snippets

---

🤝 Contributing

Found a new AI antipattern? Open a PR adding it to references/vibe-code-patterns.md and the relevant scanner.

1. Fork this repo
2. Add your pattern to references/vibe-code-patterns.md
3. Add detection to scripts/audit.py and/or scripts/audit.js
4. Add a fix template to references/fix-templates.md
5. Open a PR with a real example of the pattern "in the wild"

---

💬 Who Built This

Built by Nistal Talson — BCA Cybersecurity student, founder of FindMyPG India and N7 Productions, builder of RepoSec.

This skill was born from real pain: vibe-coding a production app, shipping it, and watching it expose secrets and crash in front of users.

If this saved your project, give it a ⭐ and share it.

---

vibe-fix — because shipping fast shouldn't mean shipping broken.

MIT License · Made with 🔥 in Kerala, India