Vibe-Switch
v1.0.2tmux for AI Agents — Orchestrate multiple AI coding agents in parallel with one command. Run Claude Code, Codex CLI, and Gemini CLI simultaneously on isolate...
⭐ 0· 20·0 current·0 all-time
byBrian Jhang@brianjhang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (tmux-like orchestrator for multiple agent CLIs) matches the declared behavior: it spawns local agent CLIs, creates git worktrees, and stores state under ~/.vibe-switch. The optional env vars listed (ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_APPLICATION_CREDENTIALS) correspond to the optional agent CLIs and are proportionate to the described purpose.
Instruction Scope
SKILL.md instructs only to install the CLI (npm) and then run local commands that create git worktrees, spawn subprocesses, and write/read ~/.vibe-switch files. It does not instruct reading unrelated system files or exfiltrating secrets itself. However, spawned agent CLIs (Claude, Gemini, etc.) may access networks and external services and thus can transmit repository contents or prompts externally — this is a consequence of orchestrating those CLIs, not an incoherence in the skill itself.
Install Mechanism
There is no auto-install spec in the registry; SKILL.md recommends 'npm install -g vibe-switch' from the public npm registry. Installing an npm package is a reasonable install path for a CLI, but it does run arbitrary third-party code on the host — a moderate risk that users should accept consciously (review package source, check maintainer, or audit install).
Credentials
Requested environment variables are conditional and tied to optional agent CLIs. The skill itself declares it does not read or store API keys. Minor inconsistency: the registry lists these env vars under 'required' with the clarifier 'only if using', which is acceptable but could be misread as mandatory; overall the credential requirements are proportionate to the skill's role as an orchestrator.
Persistence & Privilege
The skill writes local state under ~/.vibe-switch and creates/removes git worktrees — these are appropriate for a tool that manages per-task worktrees and logs. It does not set always:true, does not claim to modify other skills, and does not require global agent configuration changes.
Assessment
This skill is coherent for orchestrating local agent CLIs, but before installing consider: (1) npm install runs third-party code — review the package repo and maintainer trustworthiness before global install; (2) any agent CLIs you run (Claude, Gemini, etc.) may send your repository files/prompts to external services — avoid dispatching secrets, credentials, or sensitive files to non-sandboxed agents; (3) the tool will create git worktrees and write logs/snapshots to ~/.vibe-switch — inspect those files and clean them when needed; (4) if you need confidentiality, prefer sandboxed agents (the docs mention Codex is sandboxed) or run agents in an isolated environment; (5) minor metadata inconsistency: the registry lists no install spec but SKILL.md includes npm install instructions — expect to install the CLI yourself rather than the platform auto-installing it.Like a lobster shell, security has layers — review code before you run it.
ai-agentvk97ax91rdvv9p5qpsbzr46y9an84n6y0clivk97ax91rdvv9p5qpsbzr46y9an84n6y0latestvk97ax91rdvv9p5qpsbzr46y9an84n6y0multi-agentvk97ax91rdvv9p5qpsbzr46y9an84n6y0orchestratorvk97ax91rdvv9p5qpsbzr46y9an84n6y0vibe-codingvk97ax91rdvv9p5qpsbzr46y9an84n6y0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvANTHROPIC_API_KEY (only if using Claude agent — managed by Claude CLI, not by vibe-switch), OPENAI_API_KEY (only if using Codex agent — managed by Codex CLI, not by vibe-switch), GOOGLE_APPLICATION_CREDENTIALS (only if using Gemini agent — managed by Gemini CLI, not by vibe-switch)