Vibe Coding Best Practices v3.0

Provides a comprehensive AI-assisted development workflow with PLAN/ACT separation, multi-agent collaboration, fault recovery, and security code review best...

This skill is a coherent, instruction-only best-practices guide for AI-assisted development and appears to be what it claims. Before using its example scripts or following its automation recipes: 1) review any proposed git commands (git reset --hard, auto-push hooks) on a backup or test repo to avoid accidental data loss or unintended pushes; 2) do not enable auto-push/post-commit hooks unless the remote is trusted; 3) audit any files the agent will be instructed to read (LOG.md, memory/tasks/, status/) to ensure they contain no secrets or sensitive data; 4) follow the guide's own security red lines (manual review for auth/payment/DB schema/migrations); and 5) if you let an agent run these commands autonomously, restrict its permissions and monitor operations. These precautions will keep the guidance useful without exposing your code or secrets.

Type: OpenClaw Skill Name: vibe-3k Version: 1.0.0 The skill bundle provides comprehensive best practices for AI-assisted development, including strong recommendations for human review in security-critical areas. However, several shell scripts, particularly the 'Leader Summarization Script' in `references/03-multi-agent.md` and the `post-commit` hook in `references/04-emergency.md`, process agent-generated status files or automate Git pushes. While intended for benign purposes like progress tracking and version control, these scripts demonstrate a lack of robust input sanitization when processing data from other agents and could facilitate the exfiltration of malicious code if an agent were compromised, indicating vulnerabilities and risky capabilities without clear malicious intent.