# Wtf

Pre-launch and pre-commit audit for vibe coding projects.

- Repository: https://github.com/noobnooc/agent (1388 stars)
- Category: Testing
- License: see repository
- Last updated: 2026-08-18
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add noobnooc/agent --skill wtf -g -a claude-code -y`
Codex: `npx skills add noobnooc/agent --skill wtf -g -a codex -y`
Cursor: `npx skills add noobnooc/agent --skill wtf -g -a cursor -y`
Gemini CLI: `npx skills add noobnooc/agent --skill wtf -g -a gemini-cli -y`

## Description

Pre-launch and pre-commit audit for vibe coding projects. Use when asked to check whether a project is ready to ship, deploy, merge, or commit, especially for common AI-built app mistakes: broken project structure, committed secrets or cache files, environment variable hygiene, database migrations, ORM/schema drift, unsafe raw SQL, unused legacy code, dead routes/components, weak auth, missing tests, build failures, and deployment footguns.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# WTF

Use this skill as a hard-nosed pre-launch or pre-commit audit for fast-moving "vibe coded" projects. The goal is to find concrete blockers before code is shipped, not to produce a generic best-practices essay.

## Operating Mode

- Inspect the actual repository before judging it. Start with `git status --short`, project docs, file tree, package manifests, framework config, CI config, and deployment config.
- Keep the audit scoped to the user's target: current branch, staged changes, a PR diff, or the whole project. If unclear, default to the current worktree plus files likely to affect deploy/runtime.
- Prefer evidence over guesses. Tie every finding to a file, command output, or missing expected artifact.
- Do not print secret values. If a secret is committed or exposed, name the file and variable/key shape, but redact the value.
- If the user asks to fix issues, implement the fixes after the audit and verify them. Otherwise, remain in review/audit mode.

## Audit Workflow

1. **Map the project**
   - Identify app type, framework, package manager, runtime, deployment target, database, ORM, auth provider, and build/test commands.
   - Check whether the root is clean or dirty. Preserve unrelated user changes.
   - Find likely entrypoints: app routes, API routes, workers, server actions, CLI commands, cron jobs, migrations, schemas, and config files.

2. **Check repository hygiene**
   - Look for committed `.env*` files other than safe examples, local database files, logs, cache directories, build outputs, generated artifacts, coverage, temporary uploads, screenshots, and tool caches.
   - Verify `.gitignore` covers framework/runtime artifacts such as `.next`, `dist`, `build`, `.turbo`, `.vercel`, `.wrangler`, `.parcel-cache`, `coverage`, `node_modules`, local SQLite files, logs, and upload/cache folders.
   - Use `git ls-files` to distinguish ignored local junk from files already tracked by Git.

The rest: https://github.com/noobnooc/agent/blob/HEAD/skills/wtf/SKILL.md