# Coordinate AI Agents on a Kanban Board

Parallel AI coding work is hard to track across branches, logs, and pull requests. This skill gives practical Vibe Kanban setup guidance for local boards, MCP connections, worktree isolation, and review flow.

## Install

```bash
npx skillstore add supercent-io/vibe-kanban
```

## Metadata

- Status: approved
- Slug: supercent-io-vibe-kanban
- Version: 1.2.0
- Author version: 1.2.0
- Skillstore revision: r1
- Version status: valid
- Tree hash: 71a6397f34b4b65d3d9ff6954af423b345d02e9d2efcf1e36193b8f504ce1aee
- Author: supercent-io
- GitHub username: supercent-io
- License: MIT
- Repository: https://github.com/supercent-io/skills-template/tree/main/.agent-skills/vibe-kanban/
- Ref: 36e07d5e13068e5be64447e8f20b427cf2cbd21a
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: blocked
- Manual install advisory: allowed\_with\_warning
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, env\_access, filesystem, external\_commands
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/supercent-io-vibe-kanban
- Manifest: https://skillstore.pages.dev/api/skills/supercent-io-vibe-kanban/manifest

## Capabilities

- Explains how to start Vibe Kanban locally with npx or the provided Bash wrapper.
- Documents MCP setup for Claude Code, Codex, and OpenCode configuration files.
- Describes workspace creation, agent assignment, git worktree isolation, and pull request review.
- Provides scripts for local startup, MCP configuration, health checks, and worktree cleanup.
- Includes Docker Compose deployment guidance for remote or team board usage.
- Lists environment variables for ports, CORS, remote mode, and agent API keys.

## Use Cases

- Coordinate Parallel Feature Work: Break an epic into independent Vibe Kanban workspaces, assign agents, and review each result as a separate branch or pull request.
- Compare Agent Implementations: Run the same scoped task with different agents and compare diffs, logs, and test outcomes before choosing a direction.
- Prepare Local Agent Orchestration: Set up local MCP connections, environment variables, and health checks so agent work can be monitored from one board.

## Prompt Templates

### Start a Local Board

```
Use the Vibe Kanban skill to help me start a local board for this repository. Check prerequisites, choose a safe port, and explain what I should verify before creating a workspace.
```

### Plan Workspaces for an Epic

```
Use Vibe Kanban to split this feature into three independent workspaces. For each workspace, suggest a focused title, an agent choice, review evidence, and a pull request boundary.
```

### Configure MCP for Codex

```
Review my current setup and prepare Vibe Kanban MCP configuration for Codex. Show the files that would change and ask before writing hidden configuration files.
```

### Audit Remote Deployment

```
Evaluate the Vibe Kanban remote deployment plan for this team. Identify network exposure, secret handling, Docker risks, and safe alternatives before any deployment steps.
```

## Limitations

- Requires Node.js, git, Vibe Kanban, and the selected agent CLIs to be installed and authenticated.
- Remote deployment examples need security review before use on shared networks.
- Bash scripts assume a Unix-like shell and common tools such as curl, jq, and git.
- Does not replace human review of agent changes, secrets handling, or pull request quality.

## Best Practices

- Keep each Vibe Kanban card small enough to review as one pull request.
- Review diffs, logs, and test results before moving agent work to Done or merging a pull request.
- Keep remote mode, Docker deployment, and MCP config changes behind explicit human approval.

## Anti Patterns

- Do not run multiple broad agents against the same files without worktree isolation.
- Do not expose Vibe Kanban remote mode to untrusted networks with secrets loaded.
- Do not mount host Docker socket or write hidden agent configs without security review.

## Security Audit

- Audited at: 2026-07-07T07:17:10.025\+00:00
- Summary: The audit confirmed a critical Docker deployment risk from combining an unpinned container image with a host Docker socket mount. Additional confirmed risks include sourcing .env as shell code, persistent hidden agent configuration writes, secret-printing troubleshooting guidance, unpinned npx execution, and destructive cleanup behavior. Most Markdown backtick, localhost URL, loopback IP, and placeholder secret detections were false positives in documentation context.

## Stats

- Views: 192
- Downloads: 11
- Favorites: 0
- Popularity score: 0