de-vibelisted

# De-Vibe Vibe-coded software has a recognizable fingerprint: security holes nobody checked (wildcard CORS, committed `.env`, client-side-only auth), reliability debris (empty catches, console.log spam, tautological tests), the "AI slop" aesthetic (indigo gradients, Inter everywhere, untouched shadcn defaults, "Elevate your workflow" copy), and repo artifacts that announce how it was built. This skill removes that fingerprint and replaces the generic defaults with a small, deliberate identity — so the shipped product reads as handcrafted, and more importantly, doesn't ship with the real defects that make vibe-coded apps break in public. Two things this skill is NOT: - **Not a deception tool.** The point is closing the actual quality gap (the security holes and missing pieces ARE the tells), plus removing tool-attribution noise from what ships. It never fakes provenance, testimonials, stats, or history. - **Not a full redesign.** The identity pass is bounded: token-level design changes and copy rewrites, not new layouts or features. ## Workflow Run as four phases: **Audit → Report → Fix → Verify**. Never skip the report — the user decides on the confirm-first items before you touch them. ### Phase 1 — Audit (read-only) Detect the stack first (package.json / pyproject.toml / framework config), then sweep every category in the two reference catalogs: - `references/code-tells.md` — security, reliability, code smells, missing pieces, repo/git tells. Each item has a concrete