checkmyvibe 1.0.2 → 1.1.0

package/README.md

@@ -42,21 +42,31 @@ If you prefer not to use `npx`, copy the files manually:
 1. Create a `checkmyvibe` directory inside your agent's skills path:
    * **Project-level (Claude Code):** `.claude/skills/checkmyvibe/`
    * **Global/Personal (Claude Code):** `~/.claude/skills/checkmyvibe/`
-2. Copy `SKILL.md`, the `scripts/` folder, and the `references/` folder into that directory.
+2. Copy `SKILL.md`, the `scripts/` folder, `references/` folder, and `commands/` folder into that directory.
+3. (Optional for slash command support) Copy the files from `commands/` directly into `.claude/commands/` (or `~/.claude/commands/`).
 
 ---
 
 ## Usage
 
-Once installed, your AI coding agent will automatically recognize the `checkmyvibe` skill when relevant. You can trigger the workflow explicitly:
+### Full Production Readiness Audit
+Run a complete audit across all categories before deploying or shipping:
+* Command: `/checkmyvibe`
+* Or prompt: *"Run checkmyvibe on this project"*
 
-### Claude Code / Gemini CLI
-Open your terminal in the workspace and ask:
-> "Run checkmyvibe on this project"
-*Or:*
-> "Perform a production readiness check using checkmyvibe"
+### Focused / Scoped Scanning
+When actively developing a specific feature, run focused scans for fast, targeted feedback without running the entire test suite:
 
-The agent will walk through the checks, execute the local python validation scripts, and print a prioritized markdown report (Critical / Should Fix / Worth Reviewing) with instructions on how to correct the issues.
+| Slash Command | Scope / Keyword | Included Checks | Use Case |
+| :--- | :--- | :--- | :--- |
+| `/checkmyvibe-secrets` | `/checkmyvibe secrets` | Check 1 + Check 2 | Exposed API keys, hardcoded credentials, and `.gitignore` hygiene |
+| `/checkmyvibe-auth` | `/checkmyvibe auth` | Check 3 | Missing, mock, stubbed, or bypassed authentication guards |
+| `/checkmyvibe-db` | `/checkmyvibe db` | Check 4 | Database & BaaS rules, Supabase RLS policies, Firebase permissions |
+| `/checkmyvibe-backend` | `/checkmyvibe backend` | Checks 3, 4, 5, 6 (server), 7 | All server-side logic: auth, DB/RLS, IDOR/BOLA, SQLi/input validation, pricing |
+| `/checkmyvibe-frontend` | `/checkmyvibe frontend` | Checks 1 (client), 3 (client), 7 (client) | Client bundle key leaks, UI-only auth hiding, client-side pricing overrides |
+| `/checkmyvibe-payment` | `/checkmyvibe payment` | Check 7 | Client-side payment tampering, price overrides, and checkout integrity |
+
+The agent will walk through the scoped checks, execute relevant local helper scripts, and print a prioritized markdown report (Critical / Should Fix / Worth Reviewing) with concrete remediation steps.
 
 ---
 

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: checkmyvibe
 description: >
-  Use this skill when the user asks to "check my vibe", run a production readiness check, review code quality, do a sanity check, check for exposed environment variables, or check if the app is ready to launch/ship. Also trigger proactively when the agent is about to help deploy, publish, or push an application live, or when the codebase shows signs of AI-scaffolded patterns (Supabase/Firebase config, recently generated boilerplate, auth stubs, no existing verification) and the user has not had one done yet. Covers checking for missing or placeholder authentication, exposed secrets, permissive database rules, object-level authorization, input validation, and pricing configuration in client bundles.
+  Use this skill when the user asks to "check my vibe", run a production readiness check, review code quality, do a sanity check, check for exposed environment variables, or check if the app is ready to launch/ship, or runs a scoped check like `/checkmyvibe db`, `/checkmyvibe auth`, `/checkmyvibe secrets`, `/checkmyvibe payment`, `/checkmyvibe backend`, or `/checkmyvibe frontend`. Also trigger proactively when the agent is about to help deploy, publish, or push an application live, or when the codebase shows signs of AI-scaffolded patterns (Supabase/Firebase config, recently generated boilerplate, auth stubs, no existing verification) and the user has not had one done yet.
 ---
 # checkmyvibe — Production Readiness & Code Quality Check for Vibe-Coded Apps
 
@@ -27,14 +27,32 @@ expected them to hold real user data yet.
 
 This is a first-pass review for known, documented scaffolding failure patterns. It is not a
 comprehensive external validation, and it does not cover infrastructure hosting, third-party package
-issues, or novel/business-logic-specific flaws outside the six categories
-below. Never tell the user their app is completely "secure" or "safe" in an unqualified way.
+issues, or novel/business-logic-specific flaws outside the categories below. Never tell the user their app is completely "secure" or "safe" in an unqualified way.
 The correct language is "no issues found in this pass" or "ready to ship as far as
 these checks go" — always paired with the scope reminder in the Final Summary
 section. If the app appears to handle payments, health data, or other regulated
 data, say explicitly that a professional verification is strongly recommended regardless
 of what this pass finds.
 
+## Scope selection
+
+checkmyvibe supports targeted/scoped scanning for rapid iteration during development, as well as full audits before release. When a specific scope or slash command is specified, execute only the mapped checks:
+
+| Scope / Command Keyword | Included Checks | Description / Focus Area |
+| :--- | :--- | :--- |
+| **`secrets`** | **Check 1 + Check 2** | Exposed credentials, API keys, tokens, and `.gitignore` file protection |
+| **`auth`** | **Check 3** | Missing, mock, stubbed, or bypassed authentication guards |
+| **`db`** | **Check 4** | Database & BaaS rules, Supabase RLS policies, Firebase/storage permissions |
+| **`backend`** | **Check 3 + Check 4 + Check 5 + Check 6 (server-side) + Check 7** | All server-side logic: auth guards, database configs, IDOR/BOLA, SQLi/input validation, and payment processing |
+| **`frontend`** | **Check 1 (client-exposed) + Check 3 (client-only auth) + Check 7 (client pricing)** | Client-side bundle leaks, UI-only auth hiding, and client-controlled payment/pricing logic |
+| **`payment`** | **Check 7** | Client-side payment amount tampering, price overrides, and checkout integrity |
+| *(no argument / `full`)* | **All Checks (1–7)** | Full production readiness and code quality audit |
+
+### Rules for Scoped Runs:
+- **Execute only the selected checks:** Do not run unselected check scripts or inspect code outside the chosen scope.
+- **Explicit scope transparency:** At the start and in the final summary of the report, clearly state which checks were run and which checks were skipped.
+- **No false safety claims:** A clean scoped scan does **not** mean the app is ready for production. State clearly: *"This was a [scope]-only check. Run a full `/checkmyvibe` audit across all categories prior to launch."*
+
 ## Before you start
 
 1. **Analyze and understand the whole project first:** Walk the directory tree and analyze the repository configuration files before running any checks, generating findings, or providing instructions. Establish a solid high-level understanding of the architecture, components, and data flow.
@@ -306,11 +324,9 @@ End every review with, in this order:
 2. Total findings by severity, e.g. "2 Critical, 3 Should Fix, 1 Worth Reviewing"
 3. A one-line verdict: "Not ready to ship — fix the Critical items first" or "No
    blocking issues found in this pass — review the Should Fix items when you can"
-4. The scope reminder: "This review covers common configuration patterns seen in AI-generated code —
-   exposed secrets, auth stubs, database rules, object-level authorization, input validation,
-   and client-side payment logic. It is not a comprehensive third-party safety audit or pentest. If this app
-   handles payment, health, or other regulated data, get a professional external review
-   before launch regardless of these results."
+4. The scope reminder:
+   - **For Full Audit:** "This review covers common configuration patterns seen in AI-generated code — exposed secrets, auth stubs, database rules, object-level authorization, input validation, and client-side payment logic. It is not a comprehensive third-party safety audit or pentest. If this app handles payment, health, or other regulated data, get a professional external review before launch regardless of these results."
+   - **For Scoped Scan:** "This was a focused [SCOPE]-only check ([LIST OF RUN CHECKS]). Skipped checks: [LIST OF SKIPPED CHECKS]. A clean scoped check does not mean the application is production-ready. Always run a full `/checkmyvibe` audit prior to release, and obtain a professional external security review if handling sensitive or regulated data."
 
 ## Notes for the agent
 

package/commands/checkmyvibe-auth.md

@@ -0,0 +1,3 @@
+Read the checkmyvibe `SKILL.md`. Run only **Check 3 (missing or fake authentication)** from that skill.
+
+Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was an authentication-only check (Checks 1, 2, 4, 5, 6, and 7 were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.

package/commands/checkmyvibe-backend.md

@@ -0,0 +1,8 @@
+Read the checkmyvibe `SKILL.md`. Run only the server-side / backend checks from that skill:
+- **Check 3 (missing or fake authentication)**
+- **Check 4 (database and backend-as-a-service misconfiguration)**
+- **Check 5 (broken object-level authorization / IDOR)**
+- **Check 6 (unvalidated inputs, server-side / query portion)**
+- **Check 7 (payment and pricing logic)**
+
+Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was a backend-only check (Check 1 client bundle secrets and Check 2 .gitignore hygiene were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.

package/commands/checkmyvibe-db.md

@@ -0,0 +1,3 @@
+Read the checkmyvibe `SKILL.md`. Run only **Check 4 (database and backend-as-a-service misconfiguration)** from that skill.
+
+Use the same report format, severity rubric, and final summary structure defined there, but scope the final summary to note that this was a database-only check (Checks 1, 2, 3, 5, 6, and 7 were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.

package/commands/checkmyvibe-frontend.md

@@ -0,0 +1,6 @@
+Read the checkmyvibe `SKILL.md`. Run only the frontend / client-side checks from that skill:
+- **Check 1 (client-exposed secrets in frontend bundles and environment configurations)**
+- **Check 3 (client-side-only auth checks / UI hiding without server enforcement)**
+- **Check 7 (client-side payment or pricing logic)**
+
+Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was a frontend-only check (Check 2 .gitignore hygiene, Check 4 database rules, Check 5 IDOR, Check 6 server input validation, and full server auth checks were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.

package/commands/checkmyvibe-payment.md

@@ -0,0 +1,3 @@
+Read the checkmyvibe `SKILL.md`. Run only **Check 7 (client-side payment or pricing logic)** from that skill.
+
+Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was a payment/pricing-only check (Checks 1, 2, 3, 4, 5, and 6 were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.

package/commands/checkmyvibe-secrets.md

@@ -0,0 +1,3 @@
+Read the checkmyvibe `SKILL.md`. Run only **Check 1 (exposed secrets and credentials)** and **Check 2 (.gitignore hygiene)** from that skill.
+
+Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was a secrets-only check (Checks 3, 4, 5, 6, and 7 were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.

package/commands/checkmyvibe.md

@@ -0,0 +1,3 @@
+Read the checkmyvibe `SKILL.md`. Run a full production readiness and code quality audit across all checks (Checks 1 through 7: exposed secrets, .gitignore hygiene, missing/fake auth, database misconfigurations, IDOR/BOLA, unvalidated inputs, and client-side payment logic).
+
+Use the report format, severity rubric, and final summary structure defined in `SKILL.md`.

package/install.js

@@ -9,13 +9,17 @@ const readline = require('readline');
 const srcSkill = path.join(__dirname, 'SKILL.md');
 const srcScripts = path.join(__dirname, 'scripts');
 const srcReferences = path.join(__dirname, 'references');
+const srcCommands = path.join(__dirname, 'commands');
 
 // Destination selection
 const cwd = process.cwd();
 const hasLocalClaude = fs.existsSync(path.join(cwd, '.claude'));
 
-const localDest = path.join(cwd, '.claude', 'skills', 'checkmyvibe');
-const globalDest = path.join(os.homedir(), '.claude', 'skills', 'checkmyvibe');
+const localSkillDest = path.join(cwd, '.claude', 'skills', 'checkmyvibe');
+const localCommandsDest = path.join(cwd, '.claude', 'commands');
+
+const globalSkillDest = path.join(os.homedir(), '.claude', 'skills', 'checkmyvibe');
+const globalCommandsDest = path.join(os.homedir(), '.claude', 'commands');
 
 function copyRecursiveSync(src, dest) {
   if (fs.statSync(src).isDirectory()) {
@@ -28,34 +32,54 @@ function copyRecursiveSync(src, dest) {
   }
 }
 
-function performInstall(destPath) {
+function performInstall(skillDest, commandsDest) {
   try {
-    console.log(`\nInstalling checkmyvibe to: ${destPath}...`);
+    console.log(`\nInstalling checkmyvibe skill to: ${skillDest}...`);
     
-    // Clear destination if it already exists (overwrite mode)
-    if (fs.existsSync(destPath)) {
+    // Clear skill destination if it already exists (overwrite mode)
+    if (fs.existsSync(skillDest)) {
       if (fs.rmSync) {
-        fs.rmSync(destPath, { recursive: true, force: true });
+        fs.rmSync(skillDest, { recursive: true, force: true });
       } else {
-        fs.rmdirSync(destPath, { recursive: true });
+        fs.rmdirSync(skillDest, { recursive: true });
       }
     }
-    fs.mkdirSync(destPath, { recursive: true });
+    fs.mkdirSync(skillDest, { recursive: true });
 
     // Copy SKILL.md
-    fs.copyFileSync(srcSkill, path.join(destPath, 'SKILL.md'));
+    fs.copyFileSync(srcSkill, path.join(skillDest, 'SKILL.md'));
     
-    // Copy folders
-    copyRecursiveSync(srcScripts, path.join(destPath, 'scripts'));
-    copyRecursiveSync(srcReferences, path.join(destPath, 'references'));
+    // Copy folders into skill destination
+    copyRecursiveSync(srcScripts, path.join(skillDest, 'scripts'));
+    copyRecursiveSync(srcReferences, path.join(skillDest, 'references'));
+    if (fs.existsSync(srcCommands)) {
+      copyRecursiveSync(srcCommands, path.join(skillDest, 'commands'));
+    }
+
+    // Install slash commands into agent commands directory
+    if (fs.existsSync(srcCommands)) {
+      console.log(`Installing slash commands to: ${commandsDest}...`);
+      fs.mkdirSync(commandsDest, { recursive: true });
+      fs.readdirSync(srcCommands).forEach((cmdFile) => {
+        if (cmdFile.endsWith('.md')) {
+          fs.copyFileSync(path.join(srcCommands, cmdFile), path.join(commandsDest, cmdFile));
+        }
+      });
+    }
 
     console.log('\n=========================================');
-    console.log('🎉 checkmyvibe Agent Skill installed!');
+    console.log('🎉 checkmyvibe Agent Skill & Commands installed!');
     console.log('=========================================');
     console.log('\nHow to run checkmyvibe:');
-    console.log('1. Open your terminal in the target repository.');
-    console.log('2. Ask your coding agent: "run checkmyvibe" or "perform a readiness check"');
-    console.log('3. The agent will execute checkmyvibe\'s checks and output a prioritized report!');
+    console.log('• Full Audit:');
+    console.log('  /checkmyvibe  or  "run checkmyvibe"');
+    console.log('\n• Focused / Scoped Scans:');
+    console.log('  /checkmyvibe secrets   (or /checkmyvibe-secrets)   -> Exposed secrets & .gitignore');
+    console.log('  /checkmyvibe auth      (or /checkmyvibe-auth)      -> Authentication checks');
+    console.log('  /checkmyvibe db        (or /checkmyvibe-db)        -> Database & BaaS rules / RLS');
+    console.log('  /checkmyvibe backend   (or /checkmyvibe-backend)   -> Server-side (auth, db, IDOR, input, payment)');
+    console.log('  /checkmyvibe frontend  (or /checkmyvibe-frontend)  -> Client-side (bundle leaks, client auth, pricing)');
+    console.log('  /checkmyvibe payment   (or /checkmyvibe-payment)   -> Payment & pricing integrity');
     console.log('=========================================\n');
   } catch (err) {
     console.error('Error installing skill:', err.message);
@@ -65,7 +89,7 @@ function performInstall(destPath) {
 
 if (hasLocalClaude) {
   // If .claude folder exists in the project root, install at project level directly
-  performInstall(localDest);
+  performInstall(localSkillDest, localCommandsDest);
 } else {
   // Prompt user for local vs global/personal installation
   const rl = readline.createInterface({
@@ -74,16 +98,16 @@ if (hasLocalClaude) {
   });
 
   console.log('No local .claude/ directory detected in the current working directory.');
-  console.log(`1. Install locally to current directory: ${path.join('.claude', 'skills', 'checkmyvibe')}`);
-  console.log(`2. Install globally/personally: ${globalDest.replace(os.homedir(), '~')}`);
+  console.log(`1. Install locally to current directory: ${path.join('.claude', 'skills', 'checkmyvibe')} & ${path.join('.claude', 'commands')}`);
+  console.log(`2. Install globally/personally: ${globalSkillDest.replace(os.homedir(), '~')} & ${globalCommandsDest.replace(os.homedir(), '~')}`);
   
   rl.question('\nSelect installation destination (1 or 2, default 2): ', (answer) => {
     rl.close();
     const selection = answer.trim();
     if (selection === '1') {
-      performInstall(localDest);
+      performInstall(localSkillDest, localCommandsDest);
     } else {
-      performInstall(globalDest);
+      performInstall(globalSkillDest, globalCommandsDest);
     }
   });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "checkmyvibe",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "A structured production readiness and code quality workflow Agent Skill for AI coding assistants to catch common vibe-coded configuration issues.",
   "main": "install.js",
   "bin": {
@@ -9,6 +9,7 @@
   },
   "files": [
     "SKILL.md",
+    "commands/",
     "scripts/",
     "references/",
     "install.js",