Sean Kochel’s roundup of five relatively new GitHub repos for vibe coding — half of them under 10,000 stars. He demos each one on his own AI food-logging app and shows how they slot into a workflow. 27:30.

draw.io skill — architecture diagrams on demand (~0:26)

A Claude Code skill that uses the draw.io CLI to generate editable architecture diagrams of your repo from a natural-language request.

  • Say “visualize the layers of the services in my repo” — it explores the codebase and draws the presentation layer, front-end state, service layer, database layer, and edge functions (PostHog, OpenAI, etc.).
  • The point isn’t the diagram — it’s understanding what you built. When something breaks, you can point the model at the resolver layer instead of burning tokens on a blind “go fix this.”
  • His framing: you can only push these models as far as your expertise goes, so use the tools as learning loops.

Ponytail — the anti-over-engineering plugin (~7:59)

Makes your AI agent think like the long-ponytail senior dev who replaces your 50 lines with one.

  • ponytail guides new implementations; audit scans the whole codebase for bloat, then ranks what to delete, simplify, or replace with stdlib equivalents.
  • His audit found unused Expo imports, three near-identical error-strip components to collapse into one, and YAGNI over-engineering.
  • Repo claims ~54% less code on average (up to 94%), ~20% cheaper, ~27% faster on real Claude Code sessions.

Handy — free open-source WhisperFlow (~12:20)

Local speech-to-text dictation: press command-spacebar, talk, it types.

  • Pick your model by machine — Parakeet for speed, Whisper large for accuracy.
  • WhisperFlow costs ~$20/month and strips filler words + rewrites; Handy is free, with less polish.
  • The win: you type less, so you give the model more context. He dictated a detailed audit spec for the next tool instead of a two-line prompt.

Improve — shadcn’s codebase auditor (~15:27)

A codebase audit skill: give it a focused spec, it finds the edge cases and builds you a plan — it does NOT implement.

  • His demo: optimize the resolver functions so chats resolve deterministically instead of hitting the LLM. It found one function with the fast-path and a dozen places sending everything to the model — 4 low-risk refactors.
  • The plan goes to GitHub issues; he labels them (backlog-tagged ones are skipped), and background agents implement + open PRs for him to review. That’s the loop.

SkillSpector — NVIDIA’s security scanner for agent skills (~22:25)

Scans skill libraries (Claude Code, Codex, Gemini, MCP) for risky instructions, hidden metadata, overbroad permissions, and executable code.

  • Clone, venv, run skill-specter scan <repo>. Free tier = false-positive soup; with an OpenAI key it’s ~$0.20–0.30 on small repos, ~$5 on a big one.
  • His demo scanned a trending all-Chinese repo: “critical — do not install,” 63 issues. Top risks: scripts asking you to paste cookies (session theft) and remote code execution via unverified install scripts piped to shell.
  • Skills are a huge attack surface — worth scanning anything you install from third parties. (He even name-drops Hermes in this segment.)

How they fit together

The five tools compose into one loop: diagram → know where the problem lives → dictate the audit spec → get a plan → GitHub issues → agents implement.

“You will only ever be able to push these models as far as your expertise goes.”