Agent Skills in Claude Code and Visual Studio Code: Setup, Benefits, Risks, and a Step-by-Step Example
A person can describe a feature in natural language, ask an AI coding assistant to inspect a project, generate code, explain an error, write tests, or prepare deployment files. Tasks that once required hours of manual typing may begin with a short conversation.
That speed is real, but it can be misleading.
Generating code quickly is not the same as defining the right product, building a maintainable system, protecting user data, or proving that the software works. As AI coding tools improve, the human role does not disappear. It moves toward requirements, judgment, review, testing, architecture, and accountability.
This final article looks beyond the Personal Reading List Tracker and examines what vibe coding can do well, where it remains limited, and which skills will matter as AI-assisted development continues to evolve.
Version note: AI coding tools, model capabilities, pricing, privacy controls, and supported workflows change frequently. Verify tool-specific details against current official documentation before choosing a product or publishing technical instructions.
By the end of this guide, you should be able to:
Traditional programming often begins with a person translating an idea directly into code.
An AI-assisted workflow may look different:
Describe the goal
→ Ask the AI to inspect the project
→ Review a proposed plan
→ Approve a limited change
→ Test the result
→ Revise or commitThe developer may type fewer individual lines while spending more time deciding:
This can make software creation more accessible.
A beginner can experiment with:
An experienced developer can use the same tools for:
The value is not limited to one skill level.
The risks are not limited to beginners either.
A functioning application requires more than source code.
A complete software process may include:
Problem definition
→ Requirements
→ Design
→ Implementation
→ Review
→ Testing
→ Security analysis
→ Deployment
→ Monitoring
→ MaintenanceAn AI coding assistant can contribute to every stage.
It cannot independently guarantee that every stage was completed correctly.
For example, an AI may generate an authentication feature. That does not prove:
The code may be syntactically valid and still be unsuitable for real users.
The central limitation of vibe coding is therefore not simply that AI sometimes writes incorrect syntax.
The deeper limitation is that software quality depends on context, judgment, evidence, and responsibility.
AI tools are designed to fill gaps.
When your request is incomplete, the tool may choose:
Those choices may be reasonable.
They may also conflict with your actual needs.
Consider this prompt:
Build an app that helps people manage books.The assistant must guess whether the app needs:
A more powerful model can make more sophisticated guesses.
It cannot transform missing requirements into verified facts.
This is why the project brief in this series mattered.
The brief defined:
Better requirements improve both human-written and AI-generated software.
A coding agent may inspect many files, but it rarely has complete knowledge of the project’s real environment.
Important context may exist in:
A function may look inefficient without the history explaining why it was written that way.
A field may look unused while another system depends on it.
A database query may work with sample data but become expensive on a production table.
A configuration value may appear unnecessary while protecting backward compatibility.
The AI works from the context it can access.
The project may depend on context that was never written down.
Future tools will likely inspect larger portions of a repository and retain more project information.
That will help.
It will not automatically reveal:
Better context reduces some errors.
It does not remove the need for human confirmation.
One of the most difficult AI errors is not obviously broken code.
It is code that looks correct.
For example:
function getVisibleBooks() {
return books.filter((book) => book.status = activeFilter);
}The condition uses assignment rather than comparison.
The code may run, but it changes each book’s status while filtering.
A beginner may not notice the difference between:
book.status = activeFilterand:
book.status === activeFilterThe generated function appears simple and professional.
Its behavior is wrong.
Other plausible errors include:
innerHTML;The most dangerous output is often not obviously nonsensical.
It is output that passes a quick visual review.
An AI assistant can generate hundreds of lines quickly.
A human may need much longer to understand those lines.
This creates a review imbalance:
Generation speed
> Human understanding speedWhen the generated change is small, the imbalance is manageable.
When the change touches:
the review burden grows rapidly.
This is why large one-shot prompts are risky.
The tool may produce a complete-looking application before the user has verified:
The bottleneck moves from typing to judgment.
Future AI tools may also assist with review, but one AI system agreeing with another is not independent evidence.
Tests, observed behavior, documentation, and human reasoning still matter.
A prompt can be short while the requested system is complex.
For example:
Add login.Those two words may imply decisions about:
A beginner may see a generated form and conclude that authentication is finished.
The visible interface is only one part of the system.
Vibe coding can make complex features feel deceptively small because natural language hides the number of technical and policy decisions involved.
A useful habit is to ask:
What systems and responsibilities are hidden inside this request?
AI tools can generate secure patterns.
They can also generate:
Security depends on the complete system, not one code snippet.
For example, moving an API key from source code into a frontend environment variable may look like an improvement.
If the value is included in the browser bundle, it remains visible.
Similarly, adding a server-side proxy may hide the key but create an unprotected public endpoint that anyone can call.
Each solution changes the security boundary.
AI-generated code should be reviewed by asking:
Security is not one prompt added at the end.
It is part of the design.
Using an AI coding assistant may involve sharing project context with a service.
That context could include:
Before using any tool with private or organizational code, review its current:
Exact features and policies change, so current official documentation matters.
Regardless of tool settings, avoid sharing:
The safest secret in an AI prompt is the one never pasted there.
A generated application may work on the day it is created.
Later, you may need to:
Software that cannot be understood is difficult to maintain.
A beginner may successfully generate an application but hesitate to change it because:
This creates a maintenance gap.
The application exists, but the owner does not feel in control of it.
A strong vibe coding workflow reduces that gap through:
AI assistants often know popular libraries and frameworks.
That can lead them to add a package for problems that the existing platform can already solve.
Each dependency may introduce:
A package can still be the right decision.
It should be added deliberately.
Before accepting one, ask:
The Personal Reading List Tracker used browser features for storage, rendering, and interaction because the project did not require a large framework.
That decision kept the code easier to inspect.
A project may gradually depend on one AI tool’s:
This may be convenient.
It can also make the project harder to continue when:
The source code should remain understandable outside the AI tool.
Important project knowledge should live in durable files such as:
README.md
PROJECT_BRIEF.md
CONTRIBUTING.md
TESTING.md
architecture notes
issue tracker
Git historyAn AI conversation should not be the only place where critical decisions exist.
Vibe coding is especially useful when a task is:
Examples include:
These tasks provide visible feedback.
They also allow the user to reject the result without causing serious harm.
More caution is appropriate when the software handles:
These systems may require:
AI can assist qualified people working in these areas.
It should not create false confidence for someone who cannot evaluate the consequences.
You can evaluate a task using two questions:
A simple matrix looks like this:
| Review Difficulty | Failure Impact | Suggested Approach |
|---|---|---|
| Low | Low | Use normal small-feature workflow |
| High | Low | Reduce scope and add more tests |
| Low | High | Require specialist review and strong verification |
| High | High | Do not rely on unsupervised vibe coding |
For example:
Change:
Update button spacing
Review difficulty:
Low
Failure impact:
LowThis is a suitable AI-assisted task.
Now compare:
Change:
Modify authorization rules for customer accounts
Review difficulty:
High
Failure impact:
HighThat task requires much more than a convincing generated diff.
As code generation improves, several human skills become more important rather than less important.
The ability to describe the real user problem helps prevent unnecessary software.
Useful questions include:
A clear problem statement improves every later AI prompt.
Large features become manageable when divided into small, testable units.
For the reading list project:
Build the appbecame:
Create page structure
→ Add form behavior
→ Validate titles
→ Render books
→ Add removal
→ Add filtering
→ Add persistence
→ Test
→ DeployThis skill is central to reliable vibe coding.
Review becomes more important when more code is generated.
A reviewer asks:
The goal is not to find fault in every line.
It is to identify risk before the code becomes trusted history.
AI can propose fixes, but effective debugging still requires:
Reproduce
→ Observe
→ Hypothesize
→ Test
→ VerifyA person who can collect evidence will get better results from an AI assistant than someone who repeatedly asks it to guess.
A successful demonstration is not a complete test.
Strong testing includes:
AI can generate test cases.
Humans must decide whether those cases represent real risk.
A local code change can affect:
Systems thinking asks how the pieces interact.
This skill becomes more valuable as agents gain the ability to change several parts of a project at once.
Software development includes explaining decisions to:
Clear project briefs, commit messages, documentation, and issue descriptions remain valuable regardless of who generated the implementation.
The future of vibe coding is likely to involve more than better code completion.
Several areas are likely to become increasingly important.
These are directions rather than guarantees.
Future agents may become better at:
This could reduce incorrect assumptions.
The project will still benefit from accurate documentation.
An agent cannot rely on information that was never recorded.
A stronger agent workflow may look like:
Read requirement
→ Propose test
→ Confirm test fails
→ Implement change
→ Run test
→ Review diff
→ Report evidenceThis is more reliable than:
Generate code
→ State that it should workTests will not prove every quality, but they provide stronger evidence than a natural-language summary.
Different AI systems may focus on:
Specialization could improve review depth.
It could also create a false sense of certainty if users treat multiple AI opinions as independent proof.
Human ownership and real testing will still matter.
Future tools may offer more precise controls over:
A safer agent does not only understand the task.
It operates within a limited environment where mistakes have smaller consequences.
Useful future workflows may record:
This could improve auditability and debugging.
Git already provides part of this history.
Future tools may connect prompts, diffs, tests, and approvals more directly.
Some teams may prefer models or tools that run within controlled environments.
Possible motivations include:
Local or private deployment does not automatically make a model accurate or secure.
It changes where the data and computation are controlled.
Vibe coding may continue lowering the cost of testing an idea.
A designer, analyst, researcher, or small business owner may be able to build an interactive prototype without first mastering a large toolchain.
This can improve communication.
A working prototype often reveals questions that a static document does not.
The risk is that a prototype may be mistaken for a production-ready system.
Clear labeling and review remain important.
A fully autonomous agent may be able to complete increasingly large tasks.
That does not mean human direction becomes unnecessary.
Software projects involve choices about:
These are not purely coding questions.
A practical future workflow may resemble:
Human defines intent and boundaries
→ AI proposes and implements
→ Automated tools test
→ Human reviews evidence and risk
→ Controlled system deploys
→ Humans monitor real outcomesThe exact balance will vary by project.
Low-risk personal tools may allow more automation.
High-impact systems should require stronger oversight.
The answer depends on what is meant by “developer.”
If development means typing every line manually, AI already changes that activity.
If development means:
then the role is broader than code generation.
AI may reduce demand for some repetitive tasks.
It may also increase the number of people who can attempt software projects and the amount of software that needs review, maintenance, and integration.
The safer conclusion is not that developers disappear or remain unchanged.
The work changes.
People who can direct, evaluate, and maintain AI-assisted systems are likely to be more effective than people who either reject the tools entirely or trust them without review.
Yes, within the limits of the project and the person’s ability to verify it.
A non-developer can build a useful:
As the project grows, additional knowledge becomes necessary.
For example, moving from a local reading list to a multi-user cloud service introduces:
The first application can be a starting point.
It should not create the belief that every future system has the same risk level.
After completing the Personal Reading List Tracker, continue learning through increasingly difficult but controlled projects.
Learn:
Ask the AI to explain generated code, then test the explanation with small experiments.
Study:
These concepts make browser-based AI-generated code easier to evaluate.
Practice:
Git is not only a storage system.
It is your recovery and review framework.
Begin with small logic functions.
For example:
function normalizeBookTitle(value) {
if (typeof value !== "string") {
return "";
}
return value.trim();
}Useful tests include:
normal title
surrounding spaces
empty string
spaces only
null
numberThen move toward testing complete user behavior.
Study:
Security knowledge becomes more important as applications handle more valuable data.
A published application needs more than a URL.
Learn about:
A system that works locally but cannot be operated reliably is incomplete.
A useful next project should add one new category of complexity.
Examples include:
Avoid adding every new technology at once.
Choose one learning goal.
You can think of progress in stages.
The user asks for code and checks whether the interface appears.
Risk:
The user checks:
This is a major improvement.
The user defines:
The AI works within a clearer system.
The user uses:
The project becomes safer to change.
The user considers:
The goal is not to rush through these stages.
Each stage adds a layer of control.
This series followed a structured path.
Understand vibe coding
→ Choose a small project
→ Write a project brief
→ Create focused prompts
→ Build one feature at a time
→ Review generated code
→ Debug with evidence
→ Recover drifting sessions
→ Use Git checkpoints
→ Handle APIs and secrets safely
→ Test and deploy
→ Evaluate limits and future growthThe process matters more than the specific reading list application.
You can reuse it for another project.
Before beginning a project:
Before an AI task:
After an AI task:
Before committing:
Before deployment:
Before trusting the result:
The fastest way to generate code is rarely the fastest way to finish reliable software.
A large generated change may save typing while creating hours of review, debugging, and recovery.
A smaller sequence of verified changes often moves faster overall because each step remains understandable.
The most valuable AI-assisted development habit is not finding a magical prompt.
It is preserving control.
Control comes from:
When those qualities are present, AI tools can be highly useful.
When they are missing, faster generation can produce faster confusion.
Vibe coding lowers the cost of turning ideas into working software.
It can help beginners learn, help experienced developers move faster, and make prototypes easier to create. It can assist with planning, code generation, explanation, testing, debugging, and documentation.
Its limitations are equally important.
AI tools work with incomplete context. They can produce plausible errors, unnecessary complexity, insecure patterns, weak tests, and projects that become difficult to maintain. The speed of generation can exceed the speed of human review.
The future of vibe coding will likely include better project understanding, more capable agents, stronger testing loops, improved permission boundaries, and richer development automation.
Human responsibility will remain central.
The durable workflow is:
Define clearly
→ Generate narrowly
→ Review carefully
→ Test with evidence
→ Commit deliberately
→ Deploy responsibly
→ Maintain continuouslyThe Personal Reading List Tracker began as a simple idea and became a planned, implemented, reviewed, tested, and deployable application. More importantly, it demonstrated a process that can be applied to future projects.
The goal of vibe coding should not be to avoid understanding software.
It should be to use AI while steadily increasing your ability to understand, evaluate, and improve what you build.
No.
It can support real software development, but production systems require stronger review, testing, security, monitoring, and maintenance than a prototype.
The acceptable level of AI autonomy should depend on the project’s risk.
They may reduce the amount of syntax a person needs to memorize.
Understanding logic, data, APIs, testing, security, debugging, and system behavior will still make it easier to recognize incorrect or unsafe results.
No single skill is sufficient.
The strongest combination is clear problem definition, task decomposition, code review, testing, debugging, and the judgment to stop when evidence is insufficient.
Next article: What Comes After Your First Vibe-Coded App?
Comments
Post a Comment