gabe-align — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gabe-align (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Two responsibilities:
Rendering note. Output templates in this spec wrapped in bare triple-backtick fences are spec-meta delimiters — render their contents as plain markdown at runtime. Alignment tables and verdicts display as markdown. See gabe-docs/SKILL.md § "Runtime output rendering convention".| Mode | Alias | Values Checked | Output | Use Case |
|---|---|---|---|---|
| shallow | sf, bf | Core only (A1-A3) + project values | 3-5 lines inline | Quick sanity check, auto-trigger in gabe-roast |
| standard | (default) | All Standard (A1-A7+) + project values + advisory AP checks | Full alignment document | Before design, implementation, or non-trivial tasks |
| deep | dp | All values + advisory AP checks + brief | Alignment document + alignment brief | Greenfield projects, new architectures, major decisions |
Fires at git commit / gh pr create via hook. Runs:
| Command | What it does |
|---|---|
/gabe-align init [name] | Create .kdbp/ with BEHAVIOR.md + VALUES.md (interactive), then run readiness check |
/gabe-align init-user | Create ~/.kdbp/VALUES.md (interactive) |
/gabe-align install-hooks | Check ~/.claude/settings.json for KDBP hooks and install missing ones (with confirmation) |
/gabe-align status | Show current values (user + project) |
/gabe-align migrate | Convert old _kdbp/ to new .kdbp/ format |
/gabe-align evolve | Review value PASS/CONCERN frequency, suggest changes |
| Input Type | Example |
|---|---|
| Intent | "build a memory system for my agents" |
| File | /docs/architecture.md |
| Folder | /src/services/ |
| Task reference | dev-story 42, code-review PR-17 |
| Context | "this conversation" |
When the target references a task/story/ticket:
sprint-status.yaml, TASKS.md, STORIES.md, or similar in the current project rootValues load from three locations. All are read. Project-level has highest priority but doesn't replace others — they stack.
skills/gabe-align/VALUES.md — A1-A7 alignment valuesUsed in standard and deep modes. These are universal structural guards (user cognition, alternatives, validation before scale, etc.).
templates/architecture-principles.md
~/.claude/templates/gabe/architecture-principles.md
~/.agents/templates/gabe/architecture-principles.mdUsed in standard and deep modes as advisory AP checks. AP checks are separate from values: they produce CONCERN context and action items, but they do not count as value failures and do not block commit/PR checkpoints unless a project value or project-local rule independently makes the issue blocking. Load the first available catalog path in the order above. If none exists, note that AP checks were skipped because the catalog is missing.
~/.kdbp/VALUES.md — Universal values, all projectsCreated by /gabe-align init-user. Applied at every checkpoint and every manual check. Example:
# User Values
- **U1 — Verify Before Shipping:** Taste the dish before serving
- **U2 — Say Why:** Transparent reasoning — never output without context
- **U3 — Two Roads:** Show alternatives before committing to foundational decisions.kdbp/VALUES.md — Project-specific valuesCreated by /gabe-align init. Only loaded when working in that project. Example:
# Project Values
- **V1 — One New Thing:** One new thing, rest familiar
- **V2 — Nothing Rots:** Use what's expiring before what's exciting
- **V5 — Health Walls:** Health constraints are walls, not suggestionsAll loaded values are evaluated:
skills/gabe-align/VALUES.md fully (structural A1-A7)~/.kdbp/VALUES.md if exists (user values).kdbp/VALUES.md if exists (project values)templates/architecture-principles.md, then ~/.claude/templates/gabe/architecture-principles.md, then ~/.agents/templates/gabe/architecture-principles.md~/.claude/gabe-lens-profile.md. If the file does not exist and mode is deep, note it for the alignment brief (see Deep Mode below).a. State the value handle b. Apply the test question to the target c. Produce verdict: PASS, CONCERN, or FAIL d. If CONCERN or FAIL: explain WHAT specifically is misaligned and WHY
a. Evaluate only AP principles that the target evidence touches. b. Mark AP results as PASS, CONCERN, or NOT APPLICABLE. c. Do not fabricate AP concerns from generic preference; cite concrete target evidence. d. Keep AP results in a separate "ARCHITECTURE PRINCIPLES (advisory)" section. e. AP concerns may add action items, but they do not change the value PASS/CONCERN/FAIL counts.
/gabe-debt)12a. If .kdbp/RULES.md exists (or docs/rebuild/LESSONS.md with R-rules), before producing the final verdict, run an implicit audit-rules pass against the target:
Detection signatures).Rn ⚠ CONCERN — violates "<rule handle>" (source: RULES.md). <What to do>.kdbp/debt-ignore.md.ALIGN (shallow): [target name]
U1 ✓ | U2 ✓ | V1 ✓ | V2 ⚠ [one-line concern] | A1 ✓ | A2 ✓ | A3 ✓
Status: PASS | PROCEED WITH CONCERNS | DO NOT PROCEEDGABE ALIGN: [target name]
Date: YYYY-MM-DD
VALUES CHECKED: N
PASS: X | CONCERN: Y | FAIL: Z
U1 ✓ PASS — [one-line explanation]
V1 ✓ PASS — [one-line explanation]
V2 ⚠ CONCERN — [explanation + what to do about it]
A1 ✓ PASS — [one-line explanation]
A2 ✗ FAIL — [explanation + what the alternative looks like]
...
ARCHITECTURE PRINCIPLES (advisory):
AP8 explicit state ⚠ CONCERN — [evidence-backed concern; does not change value counts]
AP12 documented decisions ✓ PASS — [evidence-backed pass, if applicable]
ACTION ITEMS:
1. [specific action for each concern/failure]
ALIGNMENT: PROCEED | PROCEED WITH CONCERNS | DO NOT PROCEEDSame as Standard, plus:
═══ ALIGNMENT BRIEF ═══
## Intent
[Restated for clarity — what we're trying to achieve]
## Cognitive Profile Constraints
[From gabe-lens suit. What this means for structural decisions.
If no profile exists: "No cognitive profile found. Run `/gabe-lens calibrate` to generate one. Skipping cognitive constraints."]
## Structural Risks
[Risks identified by value checks — what's likely to go wrong]
## Recommended Approach
[Based on value alignment, what direction to take]
## Open Questions
[Must be resolved before designing]
## Values to Watch
[Which values are most at risk during implementation]Only evaluates session and story altitude values (not epic). Only uses Hot tier context.
📋 KDBP Checkpoint — Pre-Commit
Values (session+story altitude only):
U1 — Verify Before Shipping: ✅ PASS
U2 — Say Why: ⚠️ CONCERN — new error message gives no context
V1 — Cook First: ✅ PASS
V2 — Nothing Rots: ✅ PASS
(V3 — Shared Floor: skipped — epic altitude)
Test Scenarios:
suggestRecipes.ts:
✅ User with pantry items gets suggestions
❌ Empty pantry → shows what? (no test)
❌ Rate limit hit → user sees what? (no test)
Action: 2 untested scenarios + 1 value concern.
Fix now, or commit and track as deferred: /gabe-review deferredAfter displaying, append to .kdbp/LEDGER.md:
## 2026-04-05 14:30 — Checkpoint (pre-commit)
U1:PASS U2:CONCERN V1:PASS V2:PASS | Scenarios: 4/6 covered | Committed: pendingIf the user proceeds with a commit despite ❌ untested scenarios, write those scenarios to .kdbp/deferred-cr.md as new deferred items:
| D3 | 2026-04-05 | checkpoint | Empty pantry scenario untested | suggestRecipes.ts | UNTESTED PATH — P(high), I(high) | 1 | Deferred |Source is "checkpoint" (not a review name). This ensures that when /gabe-review runs next, it finds these items in the deferred backlog. If the same gap appears in the review's branch-test detection, Times Deferred increments to 2 → ⚠️ ESCALATED. This closes the loop between the automatic checkpoint and the manual review.
At commit/PR boundaries, after evaluating values, Claude reads the modified source files and their test files:
For each feature or behavior added/changed in the diff:
What counts as a "realistic scenario":
Skip the scenario check when:
.md, .json, .yaml, or config files changed (no source code)After the checkpoint runs (values + scenarios), append a one-line summary to .kdbp/LEDGER.md:
## 2026-04-05 14:30 — Checkpoint (pre-commit)
U1:PASS U2:CONCERN V1:PASS V2:PASS | Scenarios: 2/3 covered | Committed: yesThe Committed field is set at write time: yes if the checkpoint fires during a commit that proceeds, no if the user aborts after seeing concerns. Since the hook fires via PreToolUse (before the commit executes), always write Committed: yes — if the user cancels the commit after seeing the checkpoint, the next session's checkpoint will detect the same issues and overwrite. Do not attempt to update the field retroactively.
This gives /gabe-align evolve data to analyze. The ledger is append-only — never read during normal checkpoint flow, only by evolve.
Not all values need to be in context at all times. Load by tier to avoid context pollution:
| Tier | What | When loaded | Cost |
|---|---|---|---|
| Hot | User values (U) + project values (V) | SessionStart hook — always | ~500 bytes |
| Warm | Structural values (A1-A7) + architecture principles (AP1-AP13) | On /gabe-align standard or deep invocation | ~6KB |
| Cold | Ledger history, evolution data | Only by /gabe-align evolve | Variable |
The automatic checkpoint at commit/PR only uses Hot tier values. Structural values (A1-A7) and architecture principles (AP1-AP13) are design-level guards — they're checked when you deliberately run /gabe-align standard, not on every commit.
.kdbp/
├── BEHAVIOR.md # Project name, domain, maturity, active focus (~500 words)
├── VALUES.md # Project-specific value handles (3-7 values)
├── LEDGER.md # Checkpoint history (auto-appended, one line per checkpoint)
└── deferred-cr.md # Shared with gabe-review (created on first deferral)User-level:
~/.kdbp/
└── VALUES.md # Universal value handles (3-5 values)---
name: [project-behavior-name]
domain: [what the project does]
maturity: mvp | enterprise | scale
tech: [comma-separated stack]
created: [date]
---Followed by markdown describing purpose, active focus, and constraints. Keep under 500 words.
# [User|Project] Values
- **[ID] — [Name]:** [One sentence] `[altitude]`Example:
# Project Values
- **V1 — Cook First:** Every decision starts from "does this help someone cook better?" `session`
- **V2 — Nothing Rots:** Use what's expiring before what's exciting `story`
- **V3 — Shared Floor:** Never deploy rules without cross-app validation `epic`Each value has an altitude that determines WHEN it gets checked:
| Altitude | Meaning | Checked at |
|---|---|---|
session | Real-time relevance — check every checkpoint | Automatic checkpoint (commit/PR) |
story | Per-feature relevance — check during feature work | Automatic checkpoint + /gabe-align shallow |
epic | System-level relevance — check during planning/closing | /gabe-align standard and deep only |
If no altitude is specified, default to session (checked at every checkpoint).
At automatic checkpoints, only evaluate session and story altitude values. This keeps the checkpoint lightweight — epic-level values won't fire noise on session-level commits.
/gabe-align init [project-name]Creates .kdbp/ in the current project. Interactive:
#### Readiness Report
After writing .kdbp/ files, scan the environment and print a summary:
Gabe Suite — Readiness Report
✅ .kdbp/ created (BEHAVIOR.md, VALUES.md, LEDGER.md)
✅ ~/.kdbp/VALUES.md found (3 user values) | or ❌ Missing — run /gabe-align init-user
✅ SessionStart hook installed | or ❌ Missing — run /gabe-align install-hooks
✅ PreToolUse checkpoint hook installed | or ❌ Missing — run /gabe-align install-hooks
✅ ~/.claude/gabe-lens-profile.md found | or ⚠️ Missing (optional, for deep mode — run /gabe-lens calibrate)If any ❌ items exist, print: "Run the suggested commands to complete setup. Checkpoint hooks are required for automatic values + scenario checks at commit/PR."
/gabe-align init-userCreates ~/.kdbp/VALUES.md if it doesn't exist. Same discovery questions but aimed at cross-project patterns.
/gabe-align install-hooksChecks ~/.claude/settings.json for the two KDBP hooks and installs any that are missing. Requires user confirmation before modifying the file.
Procedure:
~/.claude/settings.jsonKDBP ActiveKDBP CHECKPOINT ✅ SessionStart hook: installed
✅ PreToolUse checkpoint hook: installedSafety rules:
See the Hook Installation section below for the exact JSON to add.
/gabe-align migrateReads old _kdbp/behaviors/*/VALUES.md and BEHAVIOR.md. Copies values and behavior into new .kdbp/ format. Discards workflows, commands, hooks, protocol docs.
/gabe-align evolveReviews checkpoint history from .kdbp/LEDGER.md. Counts per-value PASS/CONCERN frequency across recent entries.
Process:
.kdbp/LEDGER.md — parse the one-line checkpoint entries| Pattern | Trigger | Suggestion |
|---|---|---|
| Value CONCERN 3+ times | Recurring violation | "V2 has been CONCERN in 3 of last 5 checkpoints. Options: (a) reword to be more specific, (b) escalate — make it block commits, (c) accept — this is a known tradeoff" |
| Value PASS 10+ consecutive | Internalized | "U1 has been PASS for 10 straight checkpoints. Options: (a) graduate it out — add a new value, (b) keep as safety net, (c) tighten the test" |
| Scenario ❌ recurring on same file | Persistent coverage gap | "suggestRecipes.ts has had untested scenarios in 4 of last 6 checkpoints. Consider: /gabe-roast qa suggestRecipes.ts" |
| No checkpoints in ledger | Never run | "No checkpoint data yet. Run a few sessions with the hooks active, then try evolve again." |
When a check reveals a gap no existing value covers:
[U/V/A]X — "[handle]"
Guards against: [what]
Test: "[question]"
Tier: [Core / Standard / Extended]Two entries in ~/.claude/settings.json:
{
"hooks": {
"SessionStart": [{
"hooks": [{
"type": "command",
"command": "VALUES=''; if [ -f ~/.kdbp/VALUES.md ]; then VALUES=\"USER_VALUES=$(head -20 ~/.kdbp/VALUES.md)\"; fi; if [ -f .kdbp/VALUES.md ]; then VALUES=\"$VALUES PROJECT_VALUES=$(head -20 .kdbp/VALUES.md)\"; fi; if [ -f .kdbp/BEHAVIOR.md ]; then VALUES=\"$VALUES BEHAVIOR=$(head -10 .kdbp/BEHAVIOR.md)\"; fi; if [ -n \"$VALUES\" ]; then echo \"{\\\"additionalContext\\\": \\\"KDBP Active. $VALUES\\\"}\"; fi",
"timeout": 3000
}]
}],
"PreToolUse": [{
"matcher": "Bash",
"hooks": [{
"type": "command",
"command": "TOOL_INPUT=$(cat); if echo \"$TOOL_INPUT\" | grep -qE '\"command\".*git commit|\"command\".*gh pr'; then if [ -f ~/.kdbp/VALUES.md ] || [ -f .kdbp/VALUES.md ]; then echo '{\"additionalContext\": \"KDBP CHECKPOINT: Before committing, evaluate all values (from ~/.kdbp/VALUES.md and .kdbp/VALUES.md) against git diff. For each changed source file, name 3 realistic user scenarios (including errors, empty data, edge conditions) and check if each has a test. Report per-value PASS/CONCERN and per-scenario COVERED/NOT COVERED. If untested scenarios exist, suggest writing tests before committing.\"}'; fi; fi",
"timeout": 3000
}]
}]
}
}Before executing any roast, gabe-roast runs a shallow alignment:
| Checkpoint result | Suggested action |
|---|---|
| All values PASS, all scenarios COVERED | Commit freely |
| Value CONCERN | Review the diff for that value. Fix or accept. |
| Untested scenarios | Write tests for ❌ scenarios. Or: /gabe-roast qa [file] |
| Both CONCERN + untested | /gabe-review for full risk-priced review |
| Alignment doubt (wrong direction?) | /gabe-align standard for full check |
| Type | Name | Caught by |
|---|---|---|
| A | Syntax/Build | Build tools, CI |
| B | Logic | Tests, code review |
| C | Integration | E2E tests |
| D | Performance | Profiling, /gabe-health hotspots |
| E | UX | /gabe-roast UX perspective |
| F | Alignment | Values check (this tool) |
| G | Coverage | Scenario check (this tool) |
Always use for:
Automatic (no action needed):
git commit and gh pr create — hook fires checkpointDon't use for:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.