VibeCoder Skills

Score your AI coding agent setup. Level 1–80.

Everyone else counts what you spent. This counts what you built.

npx vibecoder-skills

Runs offline. Sends nothing. Prints your level in about 150 ms.

╭────────────────────────────────────────────────────────╮
│ VIBECODER SKILLS   your agent setup, scored             │
│                                                        │
│   ◈╭╨╨╮◈   LEVEL 62                                    │
│   ║▐◠ ◠▌║   SOVEREIGN  tier 7/8                        │
│   ◗▐▓▓▌╲   82.0 / 100 points                           │
│   ═┘  └═   39% to level 63                             │
│                                                        │
│   Toolkit    █████████████████████░  22.8/24           │
│   Automation ███████████████████░░░  15.3/18           │
│   Discipline ██████████████████░░░░  11.6/14           │
│   Safety     ██████████████░░░░░░░░   9.0/14           │
│   Scale      ████████████████░░░░░░   8.6/12           │
│   Depth      ██████████████░░░░░░░░   5.0/8            │
│   Burn       ███████████████░░░░░░░   6.7/10           │
╰────────────────────────────────────────────────────────╯

What it measures

Not tokens. Craft.

| axis | weight | what counts | |---|---|---| | Toolkit | 24 | skills, subagents, hooks, MCP servers, plugins | | Automation | 18 | lifecycle events covered, guards, review automation | | Discipline | 14 | CLAUDE.md / AGENTS.md depth, memory, structure | | Safety | 14 | guard hooks, tool permissions, deny rules, no keys in config | | Scale | 12 | projects, active days, how many agents you actually run | | Depth | 8 | explicit models on subagents, model variety, session density | | Burn | 10 | tokens and cost — logarithmic and capped on purpose |

Burning more money moves your level by at most ten points out of a hundred, on a log scale. Every axis has its own ceiling: a thousand empty skills score the same as forty real ones. The scale rewards learning, not spending.

Level 80 needs an essentially flawless setup. It is supposed to be rare.

Supports Claude Code, Codex, Gemini CLI, Cursor, Windsurf and opencode.

Privacy

The scan reads your setup. It never sends it.

• No paths. Not one, in any form, including hashes of paths.
• No project or repository names. Only how many.
• No prompts, no transcripts, no code. Session files are counted by their modification time; their contents are never parsed.
• Names are allow-listed. A skill called webdesign travels as webdesign. A skill called acme-payroll travels as +1 custom. The name is dropped, not stored.
• Your id is a random UUID generated on your machine. Not a hardware fingerprint.
• No IP is ever stored. Country comes from a CDN header at request time and is kept as two letters.
• No background daemon. Nothing is scheduled, nothing runs after the command exits.

Running the command sends nothing at all. Only npx vibecoder-skills submit does, and it prints the exact JSON first and asks before sending.

This is enforced by a test, not by this paragraph: privacy.spec.ts runs the scanner over fixtures stuffed with client names, paths and a key-shaped string, and fails if any of them appears in the payload. A second test deliberately breaks the redactor to prove the first test would catch a leak.

Commands

npx vibecoder-skills            # scan and print your level, offline
npx vibecoder-skills --usage    # include token history (slow once, cached after)
npx vibecoder-skills --json     # raw profile
npx vibecoder-skills submit     # show what would be sent, ask, then join the leaderboard
npx vibecoder-skills link       # get a code to connect the Telegram bot
npx vibecoder-skills auto on    # let your agent resubmit once a day (see below)
npx vibecoder-skills auto off   # stop it, everywhere
npx vibecoder-skills skill      # install a /vibecoder-skills skill for Claude Code

No terminal? Paste this into your agent's chat instead — Claude Code, Codex and Gemini all run it and read back the result:

Run: npx vibecoder-skills submit

Staying up to date

Your level only moves when your setup does, so a one-off scan goes stale. auto on installs a SessionEnd hook in every agent it finds — Claude Code, Codex, Gemini CLI — and that hook resubmits at most once a day. Nothing runs in the background: no daemon, no system scheduler, nothing happens while you are not using an agent.

Three things worth knowing before you turn it on:

• The hook pins an exact version (npx -y [email protected] auto run). A floating tag would fetch and execute the newest publish on every session, which is exactly how a compromised npm account reaches your machine. Moving to a new version stays your decision: run auto on again.
• It sends without asking, every time. That is the point of it, and it is the one thing you give up. The payload is the same one submit prints — counts, never paths or prompts — and auto off ends it.
• Your own settings are not overwritten. The installer backs up each config file next to itself, leaves existing hooks alone, and refuses to touch a file it cannot parse.

The Refresh button in the Mini App does not scan — the server has no access to your machine and never will. It leaves a flag; your next agent session picks it up and scans outside the daily schedule.

Badge

![VibeCoder Skills](https://vibecoderskills.app/badge/YOUR-HANDLE.svg)

How it is built

Three packages and one web app.

• packages/scanner — reads local setup, produces facts. Zero dependencies, so the privacy boundary can be read end to end by a human.
• packages/scoring — facts to axes to level. Pure. Constants live in data/scoring.json.
• packages/cli — the command above.
• web — leaderboard, share cards, Telegram bot and Mini App.

The server recomputes your level from the submitted facts. It never trusts a level sent by a client.

Contributing a name to the allow-list

Public, documented names only — a skill, MCP server or plugin that anyone can look up. Open a PR against data/public-names.json. A private name in that file is a leak, not an oversight: it would start travelling in other people's payloads.

License

MIT.