Gabe Suite — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Gabe Suite (Plugin) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
<img src="assets/gabe-lens-hero.png" alt="gabe-suite" width="600">
Development suite for Claude Code and Codex
Skills, commands, and hooks for understanding, reviewing, deciding, and shipping — with a knowledge system (KDBP) that tracks values, decisions, and deferred work across sessions.
Not a prompt template. Built from empirical self-observation.
</div>
Name note. The project/suite is Gabe Suite. One of the skills inside it is called Gabe Lens (invoked via /gabe-lens) — the cognitive-translation layer. They're different things: the suite contains the skill. Previous name for the suite was "Gabe Lens" — this repo was renamed to avoid collision.| Skill | Command | What it does |
|---|---|---|
| Gabe Lens | /gabe-lens | Cognitive translation — analogies, spatial maps, constraint boxes, one-line handles |
| Gabe Align | /gabe-align | Values enforcement — pre-flight checks + auto-checkpoint at commit/PR |
| Gabe Review | /gabe-review | Code review — risk pricing, confidence scoring, interactive triage, deferred items, tier drift |
| Gabe Roast | /gabe-roast | Adversarial gap review — stress-tests from a required perspective |
| Gabe Assess | /gabe-assess | Change impact — blast radius, maturity scope, prerequisites, alternatives |
| Gabe Debt | /gabe-debt | Architecture decision-debt scanner — missing decisions, rule violations, AP citations |
| Gabe Health | /gabe-health | Codebase health — god files, churn hotspots, coupling, deferred items, maintenance |
| Gabe Help | /gabe-help | Context-aware guide — scans environment, suggests the right tool |
| Gabe Mockup | /gabe-mockup | UX/mockup execution — legacy HTML recipes plus React-first Storybook modes |
| Gabe Docs | _(consulted)_ | Documentation house style — CommonMark, Mermaid library, per-well diagram recommendations (used by /gabe-teach, /gabe-init, /gabe-commit) |
| Gabe Arch | _(consulted)_ | Architecture curriculum — concept library organized by tier × specialization (used by /gabe-teach) |
The installed command surface includes direct skill commands plus the full KDBP lifecycle from project init through ship:
Both Claude Code and Codex install five thin lifecycle command-wrapper skills (gabe-next, gabe-plan, gabe-execute, gabe-commit, gabe-push). Claude Code also has native slash commands; the wrappers preserve skill-style handoff parity and load the same command specs mirrored under each local home.
| Command | What it does |
|---|---|
/gabe-align | Alignment guardian — shallow, standard, and deep checks; standard/deep include AP1-AP13 advisory checks |
/gabe-assess | Change impact assessment — blast radius, maturity scope, prerequisites |
/gabe-commit | Commit quality gate — deterministic checks, interactive triage, defer/accept/fix |
/gabe-debt | Architecture decision-debt scanner — decisions, rules, open questions, AP citations |
/gabe-execute | Phase execution — tier-cap task breakdown, mid-phase escalation gate |
/gabe-health | Codebase structural health — god files, churn hotspots, coupling, bugs |
/gabe-help | Context-aware guide — scans environment and suggests the right workflow |
/gabe-init | Project setup — creates .kdbp/, installs hooks, selects project type + maturity |
/gabe-lens | Cognitive translation — analogies, constraint boxes, Gabe Blocks |
/gabe-mockup | Mockup/UX workflow — legacy static mockups plus React-first Storybook and design-ref |
/gabe-next | Zero-logic router — reads PLAN.md and dispatches to the next gabe command |
/gabe-plan | KDBP-aware planning + per-phase tier decision with optional HTML review artifact for complex decisions |
/gabe-push | Push, create PR, watch CI, promote branches — post-commit shipping workflow |
/gabe-review | Code review — risk pricing, confidence scoring, interactive triage, deferred items |
/gabe-roast | Adversarial gap review — stress-tests from a required perspective |
/gabe-scope | Authors SCOPE.md (stable premise) + ROADMAP.md (phase plan). Multi-step, checkpoint-gated, Opus-heavy |
/gabe-scope-change | Scope-change router. Classifies your intended change → routes to -addition or -pivot |
/gabe-scope-addition | Additive scope change — inserts new REQs / phases / refs without changing premise |
/gabe-scope-pivot | Scope pivot — direction change, archives v{N} and creates v{N+1} |
/gabe-teach | Human knowledge consolidation — tracks WHY/WHEN/WHERE topics from recent commits with Socratic verification |
The Knowledge, Decisions, Behavior, and Pending system tracks project state across sessions:
.kdbp/
├── BEHAVIOR.md # Project name, domain, maturity, tech stack
├── VALUES.md # 3-7 project-specific values (checked at commit)
├── DECISIONS.md # Append-only architecture decision table
├── PENDING.md # Deferred items with priority and escalation
├── LEDGER.md # Session checkpoint history (auto-appended)
├── MAINTENANCE.md # Quarterly human checklist
├── PLAN.md # Active plan (written by /gabe-plan)
├── KNOWLEDGE.md # Human knowledge map (managed by /gabe-teach)
└── archive/ # Archived plans (completed_, defer_, cancelled_)User-level values at ~/.kdbp/VALUES.md apply across all projects.
For complex plans, /gabe-plan may also create a self-contained HTML review artifact under docs/gabe/plans/.... That HTML is the human-facing entrypoint for dense decisions, diagrams, phase maps, and bottleneck summaries; .kdbp/PLAN.md, .kdbp/DECISIONS.md, and .kdbp/LEDGER.md remain canonical for automation and lifecycle state.
~/.claude/settings.json)| Hook | Event | What it does |
|---|---|---|
| KDBP values loader | SessionStart | Loads user + project values into context |
| Plan awareness | SessionStart | Surfaces active plan goal, phase, and staleness |
| Knowledge awareness | SessionStart | Surfaces pending and stale KNOWLEDGE.md topics |
| Commit gate | PreToolUse (Bash) | Runs deterministic checks on git commit, blocks on CRITICAL |
| Ledger writer | PostToolUse (Bash) | Auto-appends commit entries to .kdbp/LEDGER.md |
| Session-end reminder | Stop | Reminds about deferred items, scope changes, and active plan |
| I need to... | Use | |
|---|---|---|
| Start a new project | /gabe-init [name] | |
| Start from a fresh idea | /gabe-align deep "idea" then /gabe-init, /gabe-scope, /gabe-plan | |
| Adopt an existing codebase | read docs/workflows/brownfield.md, then use /gabe-init or /gabe-init update | |
| Scope a new project (SCOPE.md + ROADMAP.md) | /gabe-scope | |
| Change project scope | /gabe-scope-change "description of change" | |
| Check values alignment | /gabe-align [shallow/standard/deep] | |
| Understand a concept | /gabe-lens [concept] | |
| Find gaps in a design | /gabe-roast [perspective] [target] | |
| Assess a change | /gabe-assess [change] | |
| Create or manage a plan (with tier picker) | /gabe-plan [goal] | |
| Execute the current phase | /gabe-execute | |
| Execute mockup or React Storybook UI work | /gabe-mockup | |
| Advance automatically to next step | /gabe-next | |
| Review code | /gabe-review | |
| Scan architecture decision debt | `/gabe-debt [brief | dry-run]` |
| Check codebase health | /gabe-health | |
| Commit with quality checks | /gabe-commit [message] | |
| Push, create PR, watch CI | /gabe-push | |
| Consolidate architect-level understanding | /gabe-teach [topics/status/free] | |
| What tool do I need? | /gabe-help |
| Doc | Purpose |
|---|---|
| docs/WORKFLOW.md | State machine + command flow — start here |
| docs/workflows/README.md | Greenfield vs brownfield workflow chooser |
| docs/workflows/greenfield.md | Idea-to-first-phase workflow for new apps |
| docs/workflows/brownfield.md | Adoption guide for existing codebases |
| docs/suite-state-audit.md | Current suite inventory and gap audit |
| docs/GAPS.md | Remaining workflow gaps + options |
| docs/architecture/requirements.md | Design invariants + non-goals |
| docs/architecture/diagram-standards.md | Mermaid conventions for suite docs |
| docs/architecture/scope-data-contracts.md | /gabe-scope output contract |
| docs/architecture/stack.md | Recommended application stack (Python + FastAPI + PydanticAI + React + Bun) for downstream projects |
git clone https://github.com/khujta/gabe-suite.git
cd gabe-suite
./install.sh # Install skills, commands, templates, and docs
./install.sh --dry-run # Show what would be done
./install.sh --uninstall # Remove everythingAfter install, initialize a project:
/gabe-init [project-name]This creates .kdbp/, installs hooks, and asks about project type and maturity.
Everything from here through "Cognitive Suits" describes the/gabe-lenscognitive-translation skill — the single component that shares its name with the old suite. Other skills (/gabe-review,/gabe-roast,/gabe-align, etc.) are documented further below or in their respective SKILL.md files.
Ask /gabe-lens enforcement tiers and get this:
┌─── GABE BLOCK: Enforcement Tiers ──────────────────────┐
│ │
│ THE PROBLEM │
│ Rules written in docs get ignored under fatigue and │
│ context loss. 19 files exceeded the 800-line limit │
│ despite the limit being documented everywhere. │
│ │
│ THE ANALOGY │
│ Think of it as gravity vs. posted speed limits. │
│ Gravity (Tier 1 hooks) works whether you're paying │
│ attention or not — drop a ball, it falls. Speed │
│ limits (Tier 3 docs) only work if the driver reads │
│ the sign AND chooses to comply. Tier 2 (workflows) │
│ is like a speed bump — it slows you down IF you │
│ drive over it, but you can take a different road. │
│ │
│ THE MAP │
│ │
│ Tier 1: GRAVITY ══════════════════► Always works │
│ (hooks) PreToolUse ─→ fires every edit │
│ pre-commit ─→ fires every commit │
│ │
│ Tier 2: SPEED BUMPS ─ ─ ─ ─ ─ ─ ─► Works if used │
│ (workflows) /review ─→ only if invoked │
│ │
│ Tier 3: POSTED SIGNS · · · · · · ·► Often ignored │
│ (docs) CLAUDE.md rules ─→ lost after compaction │
│ │
│ CONSTRAINT BOX │
│ IS: A reliability classification for rules │
│ IS NOT: A quality judgment (Tier 3 rules aren't │
│ bad rules — they're just badly placed) │
│ DECIDES: Where to invest enforcement effort — │
│ convert Tier 3 lessons into Tier 1 hooks │
│ │
│ ONE-LINE HANDLE │
│ "Hooks are gravity — docs are speed limit signs" │
│ │
│ SIGNAL: Quick check ✓ │
│ (The concept is intuitive once you see the tiers. │
│ Don't overthink — the tier system IS the insight.) │
└────────────────────────────────────────────────────────┘That one-line handle — "Hooks are gravity — docs are speed limit signs" — stuck for weeks. The original 3-paragraph explanation didn't last a day.
#### Full block (default)
/gabe-lens [concept or question]All components: problem, analogy, map, constraint box, one-line handle. ~200-350 tokens.
#### Brief
/gabe-lens bf [concept]Constraint box + one-line handle only. ~40-80 tokens. For previously introduced concepts.
#### Oneliner
/gabe-lens ol [concept]Just the memorable phrase. ~5-15 tokens. For compaction handoffs or re-anchoring.
#### Annotate a document
/gabe-lens an [file-path]Reads a file and produces a companion with Gabe Blocks for the 3-5 most critical concepts.
| Context | Mode | Command | Tokens |
|---|---|---|---|
| First encounter with a concept | Full | /gabe-lens | ~200-350 |
| Referencing a known concept | Brief | /gabe-lens bf | ~40-80 |
| Compaction handoff or re-anchoring | Oneliner | /gabe-lens ol | ~5-15 |
Physical systems you can visualize in 3D, in preference order:
If no good physical analogy exists, the skill says so explicitly rather than forcing a weak metaphor.
Not everyone thinks the same way. The Gabe Lens skill adapts its output to match how your brain works.
| Suit | Style | Example handle for "caching" |
|---|---|---|
| Spatial-Analogical (default) | Physical metaphors, 3D diagrams | "A fridge next to the stove" |
| Sequential-Procedural | Step-by-step, process flows | "Check the shelf before the warehouse" |
| Abstract-Structural | Patterns, types, relationships | "Every cache is a trade: space for time" |
| Narrative-Contextual | Stories, characters, scenarios | "The barista remembers your order" |
#### Calibrate
/gabe-lens-calibratePresents the same concept in all 4 suits. Pick the one that clicks. Your choice is saved globally and used for all future /gabe-lens output.
To reset to default: /gabe-lens-calibrate reset
Adversarial gap review. Adopts a perspective (architect, UX designer, security auditor, etc.) and attacks a target to find what's missing, broken, or risky.
Ask /gabe-roast "UX Designer" MOCKUP-PLAN.md and get:
GABE ROAST: MOCKUP-PLAN.md
Perspective: UX Designer
═══ MVP ════════════════════════════════════════════════
CRITICAL
M1
**Gap:** The plan starts with 12 isolated screen mockups
but defines no user flow diagrams. Each screen is designed
in a vacuum.
**One-liner:** "Building rooms before drawing the hallways"
**Effort:** M (confident)
**Lose:** Every screen gets reworked once flows reveal they
don't connect.
HIGH
M2
**Gap:** Component library is extracted BEFORE screens exist.
**One-liner:** "Packing a suitcase before knowing the destination"
**Effort:** S (confident)
**Lose:** Component library gets rebuilt from scratch once
real screens reveal actual patterns.
────────────────────────────────────────────────────────
TOTAL: 2 gaps — 1 critical, 1 highBoth inputs are required — if either is missing, the skill asks before proceeding.
/gabe-roast [perspective] [target]Brief mode (table format):
/gabe-roast bf [perspective] [target]Gaps are grouped by maturity level (MVP / Enterprise / Scale), then by importance (Critical / High / Medium / Low). Each gap includes a Gabe Lens one-liner, effort estimate with confidence, and the cost of inaction.
Rapid change impact assessment. Pauses before an "obvious yes" to surface what a proposed change actually means before you commit.
Someone proposes fixing CORS on a shared staging bucket. Before saying yes:
/gabe-assess Fix Storage CORS for staging scan testingGABE ASSESS: Fix Storage CORS for staging scan testing
Context: blocker
D1 BLAST RADIUS: External
Bucket is shared with Gustify. CORS changes affect all apps.
D2 MATURITY SCOPE: MVP
Current: MVP. Proposed: MVP-appropriate config change.
Match — but shared infra elevates risk.
D3 PREREQUISITES:
- Verify Gustify doesn't have its own CORS config
- Check who deploys staging rules (INC-001)
D4 ALTERNATIVES:
[A] Do nothing — defer E2E, unit tests already prove it
[B] Minimal — gsutil cors set + allowedEmails entry (S)
[C] Proper — combined rules deploy from Gustify repo (M)
[D] Workaround — test via admin script, bypass client (S)
RECOMMENDATION: [B] — neither change touches shared rules file
ONE-LINER: "Bucket knob and guest list — don't redecorate the shared house"/gabe-assess [change description] # Full assessment
/gabe-assess bf [change] # Brief (4 lines)
/gabe-assess il [change] # Inline (1 sentence)
/gabe-assess batch [change 1] + [change 2] # Multiple changes| Dimension | Question |
|---|---|
| D1 Blast Radius | What does this touch? (Contained / Local / Cross-cutting / External) |
| D2 Maturity Scope | Is this the right level of fix for where we are? (MVP / Enterprise / Scale) |
| D3 Prerequisites | What must be true before this change is safe? |
| D4 Alternatives | Is there a simpler, cheaper, or more appropriate path? |
project_knowledge:
optional:
- "skills/gabe-lens/SKILL.md"
- "skills/gabe-roast/SKILL.md"One-line handles from both skills enhance compaction handoff notes by surviving context compression.
<details> <summary>How the Gabe Lens skill — and later the whole suite — was built from a cognitive self-observation experiment</summary>
The suite started as a single skill called gabe-lens. That skill started as a personal experiment: what happens when you use AI to reverse-engineer how your own brain learns? Over time, workflow commands (/gabe-init, /gabe-commit, /gabe-plan, /gabe-execute, /gabe-push, /gabe-teach, /gabe-scope) and companion skills (/gabe-roast, /gabe-align, /gabe-assess, /gabe-review, /gabe-health, /gabe-help, plus the consulted-only gabe-docs and gabe-arch) accreted around it. The umbrella became the Gabe Suite. The origin skill kept its name.
I sat down with Claude and deliberately tried to learn a complex topic — attention mechanisms in neural networks. But the real goal wasn't understanding attention. It was watching how my mind processed the explanation, in real time, and having Claude observe and document the patterns.
What we discovered:
These were patterns observed during actual learning exercises, documented in real time. Once we had the cognitive profile, the next question was obvious: can we turn this into a reusable format?
The learning profile became the SKILL.md. The explanation sequence (Problem → Analogy → Code) became the Gabe Block. The overthinking trap mitigation became the constraint box. The one-liners I remembered days later became the one-line handles.
</details>
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.