vibers-code-review
Human review workflow for AI-generated GitHub projects with spec-based feedback, security review, and follow-up PRs from the Vibers service.
What this skill does
# Vibers — Human Code Review for AI-Generated Projects
You push code. We review it against your spec, fix issues, and send a PR.
## When to Use
Use this skill when:
- You want human review for AI-generated code pushed to GitHub
- You have a project spec and want reviewers to check implementation against it
- You want review feedback delivered as a follow-up PR with suggested fixes
- You are comfortable granting the Vibers service collaborator access to the repository
## Quick Start (3 steps)
### Step 1. Add collaborator
Go to your repo → Settings → Collaborators → Add **`marsiandeployer`**
### Step 2. Add GitHub Action
Create `.github/workflows/vibers.yml`:
```yaml
name: Vibers Code Review
on:
push:
branches: [main]
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 2
- uses: marsiandeployer/vibers-action@v1
with:
spec_url: 'https://docs.google.com/document/d/YOUR_SPEC_ID/edit'
telegram_contact: '@your_telegram'
```
| Parameter | What it does |
|-----------|-------------|
| `spec_url` | Link to your spec (Google Doc, Notion, etc.). **Must be publicly accessible** (or "anyone with the link can view"). Without access to spec, review is impossible. |
| `review_scope` | `full` (default), `security`, or `spec-compliance` |
| `telegram_contact` | Your Telegram — we'll message you when review is ready |
### Step 3. Add commit rules to your AI agent
Add this block to your project's `CLAUDE.md`, `.cursorrules`, or `AGENTS.md`:
```markdown
## Commit messages
Every commit MUST include a "How to test" section in the body:
- Live URL to open and verify the change
- Step-by-step what to click/check
- Test credentials if login is required
- Expected result for each step
Example:
feat: Add user registration form
How to test:
- Open https://myapp.vercel.app/register
- Fill in email/password, submit
- Check that confirmation email arrives
- Try submitting with invalid email — should show error
- Login: [email protected] / demo123
```
Without "How to test" the reviewer has to guess what to verify, and the review takes longer.
**Done.** Now every push triggers a notification. You'll get a PR with fixes, usually within 24 hours.
## What Happens After Setup
1. You push code → GitHub Action sends us the commit details
2. We read your spec and review changed files
3. We fix issues directly in code and submit a PR
4. You review the PR, merge or comment
We check: spec compliance, security (OWASP top 10), AI hallucinations (fake APIs/imports), logic bugs, UI issues.
We don't check: code style (use ESLint/Prettier), performance benchmarks, full QA (use Playwright/Cypress).
## Limitations
- Requires a GitHub repository and adding `marsiandeployer` as a collaborator
- The referenced spec must be accessible to the review workflow
- The service is not a replacement for full QA, benchmark testing, or local security review
- Turnaround depends on the external Vibers review service
## Pricing
| Plan | Rate | Details |
|------|------|---------|
| **Promo** | $1/hour | Full review + PRs with fixes. We ask for honest feedback in return. |
| **Standard** | $15/hour | Full review + security audit + priority turnaround. |
No subscriptions. No contracts. Pay per review.
## Feedback & Support
Send feedback directly from your agent:
```bash
curl -X POST https://vibers.onout.org/feedback \
-H 'Content-Type: application/json' \
-d '{"message": "Your question or issue", "repo": "https://github.com/you/your-repo"}'
```
Both `message` and `repo` are required. Response: `{"status": "accepted"}`.
Contacts:
- Telegram: [@onoutnoxon](https://t.me/onoutnoxon)
- Moltbook: [moltbook.com](https://moltbook.com) — user **noxon**
- GitHub: [marsiandeployer](https://github.com/marsiandeployer)
## FAQ
**Do I need an API key?**
No. Add collaborator + action, that's it.
**What languages?**
JS/TS, Python, React, Next.js, Django, Flask, and more. If it's on GitHub, we review it.
**What if I disagree with a fix?**
Comment on the PR. We discuss and adjust.
**Can I use this without GitHub?**
Yes — write to Telegram with your code and spec.
Related in Security
mac-ops
IncludedComprehensive macOS workstation operations — diagnose kernel panics, identify failing drives, audit launchd startup items, decode wake reasons, triage TCC permission denials, manage APFS snapshots, recover from no-boot. Use for: Mac is slow, slow bootup, won't boot, kernel panic, kernel_task hot, mds_stores CPU, photoanalysisd, cloudd, login loop, gray screen, sleep wake failure, drive failing, IO errors, APFS snapshots eating space, Time Machine local snapshots, Spotlight indexing, launchd, LaunchAgent, LaunchDaemon, login items, TCC permissions, Full Disk Access, Screen Recording denied, Gatekeeper, quarantine, com.apple.quarantine, app is damaged, helper tool, /Library/PrivilegedHelperTools, pmset, wake reasons, dark wake, sysdiagnose, panic.ips, DiagnosticReports, configuration profile, MDM profile, remote diagnostics over SSH.
a11y-audit
IncludedRun accessibility audits on web projects combining automated scanning (axe-core, Lighthouse) with WCAG 2.1 AA compliance mapping, manual check guidance, and structured reporting. Output is configurable: markdown report only, markdown plus machine-readable JSON, or markdown plus issue tracker integration. Use this skill whenever the user mentions "accessibility audit", "a11y audit", "WCAG audit", "accessibility check", "compliance scan", or asks to check a web project for accessibility issues. Also trigger when the user wants to verify WCAG conformance or map findings to a specific standard (CAN-ASC-6.2, EN 301 549, ADA/AODA).
erpclaw
IncludedAI-native ERP system with self-extending OS. Full accounting, invoicing, inventory, purchasing, tax, billing, HR, payroll, advanced accounting (ASC 606/842, intercompany, consolidation), and financial reporting. 413 actions across 14 domains, 43 expansion modules. Constitutional guardrails, adversarial audit, schema migration. Double-entry GL, immutable audit trail, US GAAP.
assess
IncludedAssesses and rates quality 0-10 across multiple dimensions (correctness, maintainability, security, performance, testability, simplicity) with pros/cons analysis. Compares against project conventions and prior decisions from memory. Produces structured evaluation reports with actionable improvement suggestions. Use when evaluating code, designs, architectures, or comparing alternative approaches.
spring-boot-security-jwt
IncludedProvides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.
code-hardcode-audit
IncludedDetect hardcoded values, magic numbers, and leaked secrets. TRIGGERS - hardcode audit, magic numbers, PLR2004, secret scanning.