agent-architect-kit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-architect-kit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Status: shipped 2026-04-21. Test-backed. CLI-automatable. Safe to recommend publicly.
agent-architect-kit by @ultrathink-art is a CLAUDE.md + agent-role template kit that persists learnings as per-role markdown files (agents/state/memory/<role>.md). They solve the setup layer. ThumbGate solves the runtime-enforcement layer — PreToolUse hooks that actually block known-bad tool calls instead of hoping the agent reads its memory file.
The two stacks are complementary. A team running architect-kit graduates to ThumbGate when their markdown memory grows past the ~80-line ceiling their own memory-directive.md enforces, or when they want their operations meta-agent to do more than edit instructions — actually prevent the failing action.
This bridge turns that graduation into a one-shot command.
scripts/integrations/architect-kit-memory-bridge.js walks an architect-kit memory directory, parses each per-role .md file, and emits one ThumbGate feedback entry per qualifying line:
| architect-kit section | → ThumbGate signal | notes |
|---|---|---|
## Mistakes | down with whatWentWrong | every entry becomes a thumbs-down lesson |
## Learnings | up with whatWorked | every entry becomes a thumbs-up memory |
## Stakeholder Feedback | up/down depending on keywords | "rejected", "broken", "wrong", "hate", etc. flip negative |
## Session Log | skipped | too granular to be useful in a searchable lesson DB |
Every ingested entry is tagged architect-kit, role:<name>, and the source section, so imports are auditable and rollbackable.
Dry-run first (no writes, prints classification):
npm run integrations:architect-kit:import -- \
--dir=/path/to/agents/state/memory \
--dry-run --jsonReal import (writes to ThumbGate feedback log):
npm run integrations:architect-kit:import -- \
--dir=/path/to/agents/state/memorySingle role (e.g. import only coder.md):
npm run integrations:architect-kit:import -- \
--dir=/path/to/agents/state/memory \
--role=codernpm run feedback:stats # see new entries grouped by tag
npm run feedback:rules # regenerate prevention rules from the imported mistakesThe imported mistakes now feed the same pipeline as native ThumbGate feedback: lesson DB indexing, Thompson Sampling rollups, prevention-rule generation, and PreToolUse hook injection. The architect-kit operations agent's "edit the instructions" loop is now backed by hooks that can actually refuse a tool call.
npm run test:architect-kit-memory-bridge
# 16 tests, 0 failFixtures live in tests/fixtures/architect-kit-memory/ and mirror the exact format from architect-kit's memory-directive.md. The test-suite parity guard (tests/test-suite-parity.test.js) pins this test into the npm test chain — dropping the test accidentally now fails CI.
operations meta-agent edits instructions. ThumbGate lets operations also register prevention rules that PreToolUse hooks honor — the same loop, but the agent literally cannot skip it.npm run feedback:rules. Wire that into your Ralph Loop (or theirs) if you want continuous re-derivation.scripts/integrations/architect-kit-memory-bridge.js — parser + importer + CLItests/architect-kit-memory-bridge.test.js — 16 unit teststests/fixtures/architect-kit-memory/{coder,qa}.md — fixtures matching their formatpackage.json — new test:architect-kit-memory-bridge and integrations:architect-kit:import scripts, chained into npm testskills/agent-architect-kit/SKILL.md — this docIf they ship stable entry IDs in their memory format, upgrade the bridge to do incremental imports (skip already-seen entries). Until then, treat this as a one-shot migration tool, not a sync daemon.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.