AI Code Guardian · v0.3.0

Audit AI Code for Hallucinated Packages & Leaked Keys Before Merge

VibeShield inspects local git diffs in under 1 second. Catches nonexistent npm/pip packages (slopsquatting), leaked API tokens, and insecure scaffolding patterns before they enter production.

$ curl -fsSL https://vibeshield.dev/install.sh | bash

Download Binary Live Inspection Demo Star on GitHub

100% Local & Offline · Zero Network Egress · MIT Open Source

terminal — vibeshield scan .

LOCAL AUDIT

$ vibeshield scan .

Scanning 18 files (staged diff mode)… done in 0.38s

CRITICAL · VS-PKG-001 Hallucinated Package

package.json:14 — fast-parse-utils-v3 (package does not exist in registry)

→ Fix: replace with native node:util (zero extra dependencies).

HIGH · VS-SEC-017 Hardcoded Secret

src/agent.ts:42 — OPENAI_API_KEY pasted directly from chat context

→ Fix: read from process.env.OPENAI_API_KEY and rotate the key now.

✓ 16 files clean · 2 atomic fixes generated 0 leaks merged

Engine Compatibility: Cursor Integration Claude Code Plugin Windsurf Cascade Rules GitHub Copilot Gate Aider Terminal Audit Hunt Hallucinated Packages Catch Leaked API Secrets

Core Capabilities

Built Specifically for AI-Generated Code

Traditional security scanners search for known historical CVEs. VibeShield inspects the new failure modes introduced when LLMs write code.

SLOPSQUATTING DEFENSE

Hallucinated Package Blocker

LLMs routinely invent plausible package names. Attackers register these hallucinated names on npm and PyPI within hours. VibeShield checks package age, maintainer count, and registry existence before installation.

ENTROPY SCANNER

Zero-Leak Secret Quarantine

Catches OpenAI, Anthropic, AWS, GitHub, and database credentials echoed by coding agents into source files or test fixtures. Generates immediate rotation warnings before git commit.

SCAFFOLD SANITIZER

Insecure Boilerplate Blocker

Refuses unsafe AI scaffolding defaults: wildcard CORS (*), unhashed passwords, disabled TLS verification, JWT alg "none", and eval() executed directly on model outputs.

AIR-GAPPED PERFORMANCE

Sub-Second Local Execution

Written in high-performance native code. Runs in under 400ms across your local git diff. 100% offline, zero cloud calls, zero telemetry — your intellectual property never leaves your laptop.

Audit Matrix

Live Code Inspector & Threat Detector

Inspect how VibeShield flags dangerous AI code patterns in real-time — from hallucinated package names to leaked API keys, with verified atomic fixes.

Select an AI code scenario to test:

CRITICAL BLOCK PR #482 · package.json

0.38s local scan

Scanned Code Line

+ import { parse } from "fast-parse-utils-v3";

Threat Analysis

Cursor agent hallucinated a plausible package name. Threat actors register these hallucinated names on npm within hours to execute remote payloads during npm install.

✓

Recommended Fix

Replace with native node:util (clean, 12 lines, zero extra dependencies).

Write with AI

Generate code with Cursor, Copilot, or Claude Code.

Audit Staged Diff

VibeShield inspects changed lines in sub-second offline check.

Merge Safely

Apply 1-line atomic fixes with zero security regressions.

Agent Rules & Prompts

Adversarial Guardrails for Your AI Coding Agent

Select your AI coding tool below to copy pre-tuned rule prompts that force the agent to audit dependencies, ban leaked keys, and verify diffs before suggesting code.

Cursor Guardrail Configuration

Paste into your project root as `.cursorrules` to instruct Cursor to hunt and fix AI bugs automatically before saving.

Config File: .cursorrules

Adversarial Prompt Content

# VibeShield Bug Hunter Rule for Cursor
You are an adversarial code auditor and bug hunter for vibe-coded applications.
Before finalizing, applying, or committing any code in this project:
1. HALLUCINATION CHECK: Audit every imported package, module, or API. If a library is not well-established, flag it and replace with standard library or verified packages.
2. SECRET SCAN: Ensure NO OpenAI, Anthropic, Stripe, AWS, or database credentials are leaked in client-side code or git diffs.
3. LOGIC & COMPONENT TESTING: Inspect state updates, race conditions, async error handling, and broken edge cases in UI components.
4. INSECURE DEFAULTS: Never scaffold wildcard CORS (*), debug=True, weak session secrets, or JWT algorithms:["none"].
5. ATOMIC FIX: For every bug found, provide an immediate one-line diff replacement.

Paste directly into your repository

View rule configs on GitHub →

Claude Code Guardrail Configuration

Install the official VibeShield bug-hunting skill or run direct audit prompts in your Claude Code sessions.

Config File: ~/.claude/skills or /plugin

Terminal Command

/plugin marketplace add rajviyash9136freefr-tech/vibeshield && /plugin install vibeshield@vibeshield

Adversarial Prompt Content

/vibeshield:vibeshield-audit --quick

Please audit this vibe-coded project:
1. Hunt for hallucinated npm/pip packages and unverified imports.
2. Check for leaked API tokens, hardcoded secrets, and insecure endpoints.
3. Test component logic, broken state flows, and unhandled exceptions.
4. Output a verified VibeCheck report and apply 1-line fixes.

Paste directly into your repository

View rule configs on GitHub →

Windsurf (Cascade) Guardrail Configuration

Add to `.windsurfrules` in your workspace so Cascade constantly tests output for vibe coding bugs.

Config File: .windsurfrules

Adversarial Prompt Content

# VibeShield Security & Bug Hunter for Windsurf Cascade
When generating or refactoring code in this repository:
1. Verify all dependencies against hallucinated package names (slopsquatting).
2. Scan all generated code for credentials, API tokens, and private environment variables.
3. Test edge-case logic, error handling, and component state transitions.
4. Reject insecure boilerplate: wildcard CORS, disabled auth, and unsafe evals.
5. Provide safe, production-grade replacements for any identified vulnerability.

Paste directly into your repository

View rule configs on GitHub →

GitHub Copilot Guardrail Configuration

Commit to `.github/copilot-instructions.md` to guide Copilot Chat & Agent PR reviews.

Config File: .github/copilot-instructions.md

Adversarial Prompt Content

# VibeShield Bug Hunter Instructions for GitHub Copilot
Act as VibeShield Bug Hunter and adversarial code reviewer for AI-generated diffs:
1. Identify hallucinated packages and unpinned supply chain risks in package manifests.
2. Quarantine any hardcoded secrets, API tokens, or credentials echoed from context.
3. Scrutinize component state, edge cases, and asynchronous error boundaries.
4. Flag insecure defaults (CORS *, debug flags, permissive JWTs) and suggest clean diff fixes.

Paste directly into your repository

View rule configs on GitHub →

Aider / Terminal CLI Guardrail Configuration

Run directly in your terminal or pass to Aider / custom agent scripts.

Config File: Terminal / Bash

Terminal Command

npx vibeshield scan --diff main

Adversarial Prompt Content

npx vibeshield scan --diff main

# Or run full repository bug-hunt audit:
npx vibeshield scan .

Paste directly into your repository

View rule configs on GitHub →

Deployment

Install VibeShield in Under 60 Seconds

Install the offline binary for Windows, macOS, or Linux, add it as a git pre-commit hook, or enforce it in CI via our official GitHub Action.

# macOS & Linux (Bash):
curl -fsSL https://raw.githubusercontent.com/rajviyash9136freefr-tech/vibeshield/main/scripts/install.sh | bash

# Windows (PowerShell):
irm https://raw.githubusercontent.com/rajviyash9136freefr-tech/vibeshield/main/scripts/install.ps1 | iex

# Then confirm it is wired up:
vibeshield doctor

# Claude Code:
claude plugin marketplace add rajviyash9136freefr-tech/vibeshield
claude plugin install vibeshield@vibeshield

# Cursor / VS Code / Windsurf:
# Automatic via install script, or copy .cursorrules from the Agent Prompts section above!

# Instant scan without installation:
npx vibeshield scan .

# Or install globally via npm:
npm install -g vibeshield

# Tab completion, once installed:
vibeshield completion bash >> ~/.bashrc

# .github/workflows/vibeshield.yml
name: VibeShield PR Gate
on: [pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: rajviyash9136freefr-tech/vibeshield/action@v3.0.1

Zero accounts, zero external API keys, 100% free and open-source

CLI & Workflow Guide

How to Scan & Fix Insecure AI Code

Run instant local audits from your terminal or inside your agent. Copy any command below to test your workspace immediately.

1. Scan Entire Project

Full Audit

Audit all repository files, dependency manifests, and components for hallucinated packages, leaked keys, and insecure code.

vibeshield scan .

2. Scan Git Diff Against Main

PR Speed

Audit only the changed files from your current AI coding session before opening a pull request.

vibeshield scan --diff main

3. Scan Staged Files (Pre-Commit)

Fast Hook

Sub-second check before git commit. Blocks secrets and hallucinated imports before they enter git history.

vibeshield scan --staged

4. Automatically Apply 1-Line Fixes

Auto-Remediate

Interactively preview and auto-remediate flagged hallucinated packages with verified standard library replacements.

vibeshield fix .

Terminal Output Preview

Completed in 0.38s

$ vibeshield scan .

Scanning 14 project files (diff mode)… done in 0.38s

CRITICAL VS-PKG-001 hallucinated-package

package.json:8 — fast-parse-utils-v3@2.1.4

Why: Package does not exist in registry. Slopsquatting risk.

→ Fix: Replace with standard library node:util (12 lines, zero dependencies).

HIGH VS-SEC-017 hardcoded-secret

src/agent.ts:41 — OPENAI_API_KEY = "sk-proj-••••••••••••••4a2f"

Why: Copilot pasted credentials echoed from conversation context memory.

→ Fix: Read from process.env.OPENAI_API_KEY and rotate the leaked key now.

✓ 12 files clean · 2 findings · 0 unverified dependencies merged

FAQ

Frequently Asked Questions

Everything you need to know about AI package hallucinations, offline privacy, and integration with your workflow.

What is VibeShield and how does it test vibe-coded apps?

VibeShield is an adversarial bug hunter and security tester built specifically for AI vibe coding. When AI agents (Cursor, Claude Code, GitHub Copilot, Windsurf) generate hundreds of lines of code, they introduce hallucinated packages, leaked keys, and broken component logic. VibeShield inspects code the moment it is written, hunts these specific bugs, and gives you instant 1-click fixes before you commit or merge.

Explore Agent Prompts →

How do I install VibeShield and use it with my AI coding agent?

Four ways, one binary. (1) Run the install script on macOS/Linux or the PowerShell installer on Windows. (2) Copy our agent prompt into .cursorrules, .windsurfrules or the Claude Code plugin. (3) Add the GitHub Action to gate every pull request in seconds. (4) npx vibeshield scan . for a zero-install scan. Then run vibeshield doctor to confirm everything is wired up.

View Installation Options →

What specific bugs and vulnerabilities does VibeShield hunt down?

VibeShield targets failure modes unique to LLM-generated code: hallucinated npm/pip packages (slopsquatting attacks where attackers pre-register names invented by LLMs), leaked API keys and passwords echoed in boilerplate, insecure wildcard CORS (*), broken JWT auth, stripped licence headers, and prompt-injection backdoors. 122 rules across 6 categories — all readable with vibeshield rules.

Test with Live Simulator →

Does my source code or prompt data leave my machine?

No. Never. VibeShield is designed for zero data exfiltration. The CLI, console, pre-commit hook, GitHub Action and agent skill all execute 100% locally using static analysis. There is no telemetry, no account, no dashboard, and no server component — the scanner links in no HTTP client at all. Your code, API keys, and prompts are never sent anywhere.

Read the security model →

Is VibeShield free, and can I use it for private repositories?

Yes. VibeShield is 100% free and open-source under the MIT license. There are no paid tiers, no seat limits, no tokens, and no account required. You can freely use it on unlimited personal, public, and private commercial repositories forever.

View GitHub Repository →

Audit Your AI Code Before It Enters Production

Scan local git diffs in under 1 second. 100% offline static binary analysis with zero code or tokens sent to external servers.

Download VibeShield Copy Agent Guardrails ★ Star on GitHub

MIT Licensed · 100% Free · No account required · Open Source