Vibe-SkillsBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: vibe
description: Vibe Code Orchestrator (VCO) is a governed runtime entry that freezes requirements, bounds execution, and enforces verification and phase cleanup.
---

# Vibe Governed Runtime Entry

This file is the host-facing SOP for entering canonical `vibe`. Keep it small: runtime details belong in `protocols/runtime.md`, execution discipline belongs in `protocols/do.md`, and host wrapper recipes belong in installer-generated wrapper docs.

## Trigger Contract

Enter canonical `vibe` before ordinary execution when the user explicitly invokes `$vibe`, `/vibe`, or the `vibe` skill, or when the host intentionally chooses governed requirement/plan/execution closure for a complex task.

Do not route every loosely related task into `vibe`. Lightweight questions,
single-command checks, or tasks better served by another explicitly requested
skill may proceed outside `vibe` unless the user explicitly invoked this entry.

Installed-copy updates use `update --skills-dir <skills-dir>` on the same managed directory.

User instructions, including CLAUDE.md, GEMINI.md, AGENTS.md and direct workflow limits such as TDD exceptions, remain highest priority. Preserve canonical launch and proof rules within those limits.

## Canonical Bootstrap

`vibe` is a host-syntax-neutral skill contract. Before canonical launch, do only the minimum needed to launch:

- Resolve `skill_root` and `workspace_root`.
- Pass the current user task verbatim as the task specification; unrelated chat history may be excluded. Do not summarize, rewrite, or reduce it to keywords. Preserve exact input paths, input immutability constraints, exact output roots, synthetic-data evidence boundaries, module dependencies and safe parallel boundaries, and acceptance criteria.

Do not search the current workspace, repository, or install root for canonical proof files before launch.
Do not inspect the repo, protocol docs, or prior run outputs before canonical launch returns.
Do not simulate stages, claim canonical entry from reading this file or wrapper text, or treat wrapper or AGENTS text as proof.
Do not manually create `outputs/runtime/vibe-sessions/<run-id>/`.
Do not use the Vibe installation root as the governed artifact root.

Local skill candidate audit: semantic owner `packages/runtime-core/src/vgo_runtime/router_contract_runtime.py`; compatibility bridge `scripts/router/resolve-pack-route.ps1`

The audit runs inside canonical `vibe` and exposes candidates for inspection. Include work type, domain/technology, deliverable, explicit constraints, and verified frozen facts on continuation. Its output is compatibility evidence only; the Agent owns skill choice, binding, and stage progression.

Canonical entry command shape:

```powershell
$env:PYTHONPATH = "<skill_root>/apps/vgo-cli/src"
py -3 -m vgo_cli.main canonical-entry --repo-root "<skill_root>" --artifact-root "<workspace_root>" --prompt "<current user task, verbatim>"
```

For PowerShell, do not place `$env:PYTHONPATH=...` inside a double-quoted `-Command` string; host interpolation may corrupt it to `:PYTHONPATH`.

Bash-like hosts, including Claude Code, set `PYTHONPATH` in the outer shell and call Python directly. Try `py -3`, `python`, then `python3` according to availability.

```bash
REPO_ROOT='<skill_root>'
WORKSPACE_ROOT="${WORKSPACE_ROOT:-$PWD}"
PYTHONPATH="$REPO_ROOT/apps/vgo-cli/src" python -m vgo_cli.main canonical-entry --repo-root "$REPO_ROOT" --artifact-root "$WORKSPACE_ROOT" --prompt "<current user task, verbatim>"
```

`--host-id` and `--entry-id` remain compatibility-only for wrappers or older automation; omit them on a normal launch.

Only validate canonical proof artifacts after canonical-entry returns a `session_root`.
`check` proves `installed locally`; runtime coherence and delivery acceptance require their own evidence.
Proof of canonical launch is post-launch and requires: `host-launch-receipt.json`, `runtime-input-packet.json`, `governance-capsule.json`, and `stage-lineage.json` under the returned `session_root`.
`local-agent-kernel` follows the same proof rule. If it cannot produce those truth artifacts, it may produce local work scaffolds, but it must not be treated as `canonical verified`.
If canonical launch fails, report `blocked` with the concrete failure reason instead of simulating the missing stages or proof artifacts.

## Consensus And Task Evolution

Use `deep_interview` until the user and Agent agree on the goal, scope, constraints, deliverables, relevant unknowns, and completion criteria. Freeze the requirement after confirmation of that task-specific summary; the first clarification is an input to the conversation.

Keep the agreement in the existing TaskCard. Append accepted revisions, update affected work and checks, and reuse results only while their inputs and acceptance remain valid. Surface decisions that change the agreed outcome, scope, risk, or required human judgment.

## Hard Stop And Re-entry

The progressive governed stops are `requirement_doc`, `xl_plan`, and `phase_cleanup`.

When `bounded_return_control.explicit_user_reentry_required = true`, stop the
current assistant turn. Do not consume re-entry credentials until a later user
message approves or revises the current boundary.

This is a hard runtime boundary, not a suggestion. It overrides ordinary host
autonomy rules such as "continue until done." A detailed original request is not
approval of the frozen requirement or frozen plan. After a hard stop, do not
perform equivalent manual work outside governed re-entry: no plan writing, task
execution, manual workaround delivery, or final artifact delivery in the same
assistant turn.

For re-entry, inspect `runtime-summary.json ->
bounded_return_control.host_decision_contract`, infer the user's intent, and
write a structured host decision JSON file. Use the same `run_id`,
`bounded_reentry_token`, and stable `workspace_root`:

At a requirement stop, build `agent_skill_organization` directly from `agent_skill_organiza

BLOCKgrade F · trust 33/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (5 observation(s))

Network

declared (10 observation(s))

Shell

declared (4 observation(s))

Dependencies

pinned

Secrets in source

found

Findings (25)

Set via environment variable to avoid hardcoding: `EDGAR_IDENTITY="Your Name [email protected]"`.

exec(compile(shared_script.read_text(encoding="utf-8"), str(shared_script), "exec"), globals_dict)

exec(compile(shared_script.read_text(encoding="utf-8"), str(shared_script), "exec"), globals_dict)

exec(compile(shared_script.read_text(encoding="utf-8"), str(shared_script), "exec"), globals_dict)

<INSTRUCTIONS>

<INSTRUCTIONS>

Important: When referencing code in the report, make sure to find and include line numbers for the code you are referencing.

# Debugger Agent Template

# Planner Agent Template

# Reviewer Agent Template

# Security Reviewer Template

# arch-critic Prompt

mod = __import__(import_name)

print(f"   export OPENROUTER_API_KEY={args.api_key}")

protein_seq = "MENFQKVEKIGEGTYGVVYKARNKLTGEVVALKKIRLDTETEGVPSTAIREISLLKELNHPNIVKLLDVIHTENKLYLVFEFLHQDLKKFMDASALTGIPLPLIKSYLFQLLQGLAFCHSHRVLHRDLKPQNLLINTEGAIKLADFGLARAFGVPVRTYTHEVVTLWYRAPEILLGCKYYSTAVD

ax.set_ylabel('Depth (μm)')

print(f"  Estimated drift range: {drift_estimate:.1f} μm")

print(f"Drift > 20 μm detected, applying motion correction...")

[CmdletBinding()]

[CmdletBinding()]

[CmdletBinding()]

[

--db postgresql://user:pwd@host:port/db

--db postgresql://user:pwd@host:port/db

--db postgresql://user:pwd@host:5432/db

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.

[![ModelsAtlas audit: Vibe-Skills](https://modelsatlas.com/skills/foryourhealth111-pixel/vibe-skills/badge.svg)](https://modelsatlas.com/skills/foryourhealth111-pixel/vibe-skills/)

Not your listing, or something out of date? Claim or update your listing.