claude-vibe-skills

One skill for disciplined vibe coding. Claude doesn’t commit without your say-so, doesn’t ship without walking the gates, and can’t quietly skip either.

🔢 VERSION  →  🔨 BUILD  →  🔒 SECURITY  →  📄 DOCS  →  📦 RELEASE  →  🚀 SHIP

⬇ Download dev-skills.skill — current version v2026.10.23

GitHub repo · Release notes for v2026.10.23

---

Contents

• What it does — the four rules
• Enforcement checks — what’s actually checked, full disclosure, and how to decline
• What’s new — the last few releases
• What it looks like — a session, abridged
• Install — claude.ai, Desktop, CLI, web
• The six gates — what each one checks
• Two tracks — why a work commit isn’t a release
• Manual and semi-autonomous mode — who runs the commands
• How gates are enforced — the state file, and why memory isn’t trusted
• Execution environments — local vs. container vs. Termux
• Workflow detection — local dev vs. CI
• Cost discipline — what’s automatic, what you have to ask for
• Project standards — security architecture section, encryption at rest, login protections, main-page links, Apprise, compose quickstart
• Security architecture — how this repo is built with regard to security, and what has changed
• Audit mode · Shortcut detection · What’s inside · For maintainers

---

What it does

1. Commits require approval. Claude never runs git commit, git push, or gh pr create without your explicit say-so. No surprise commits after a single edit. A vague “ok” doesn’t count, and neither does a hook telling Claude the tree is dirty. This is the one rule semi-autonomous mode doesn’t relax.

2. All work happens on branches. Never directly on main/master. At session start the skill finds the repo, offers to sync when you’re behind origin, and flags you if you’re sitting on the default branch.

3. Gates run before anything ships. A work commit needs the security gate and your approval. Anything that bumps a version, builds an artifact, tags, or publishes runs all six, in order. Presenting a git command for you to paste counts as running it — the same pre-flight fires either way.

4. Security and quality get scanned. After every build, a full scan checks for hardcoded secrets, injection vectors, spaghetti code, N+1 queries, and more. Critical and High findings block the release.

---