gabe-arch — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gabe-arch (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 3 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A cross-project library of architecture concepts that accumulates as the human verifies them during project-driven /gabe-teach sessions. The goal is not to teach architecture in the abstract — it is to reinforce universal architecture concepts while developing real apps, so the human gradually becomes architect-minded (tradeoffs, scalability, reliability) without ever sitting through a disconnected lecture.
/gabe-teach topics) live in per-project .kdbp/KNOWLEDGE.md, driven by commits.skills/gabe-arch/concepts/, driven by the catalog below.ArchConcepts column in .kdbp/KNOWLEDGE.md's Topics table).~/.claude/gabe-arch/STATE.md — the global, cross-project source of truth./gabe-teach arch enters dedicated architecture mode: browse, teach, verify, or let the system pick the next concept via progressive pressure.See TAXONOMY.md for the full map. Summary:
foundational · intermediate · advancedagent · web · data · distributed-reliability · security · infra · costA concept can belong to multiple specializations (e.g., retry-with-backoff is [distributed-reliability], retry-aware-cost-cap is [cost, distributed-reliability]). Tier is singular.
Every file under concepts/{specialization}/{slug}.md follows this shape exactly. Schema validation is manual for v1 — no linter yet.
---
id: kebab-case-unique-id
name: Human-readable Name
tier: foundational | intermediate | advanced
specialization: [spec-1, spec-2, ...] # 1-N from the 7 specs
tags: [free-form, searchable, keywords]
prerequisites: [concept-id, concept-id] # 0-N; may span specializations
related: [concept-id, concept-id] # 0-N; non-blocking sibling concepts
one_liner: "5-15 word mental model used in /gabe-teach Architecture-link rendering."
---
## Analogy
2-3 sentences. A physical / spatial / mechanical picture that sticks. Same
voice as the `gabe-lens` skill's analogy mode.
## When it applies
- 2-5 bullets: conditions where this concept is the right move.
## When it doesn't
- 2-5 bullets: conditions where this concept is a trap or overkill.
## Primary force
1 paragraph (≤4 sentences). The single strongest reason the concept exists.
If you can't pick one force, the concept is too broad — split it.
## Common mistakes
- 2-4 bullets. Concrete failure modes junior engineers hit.
## Evidence a topic touches this
Rules used by `/gabe-teach` Step 4b.5 for deterministic tagging. Format:
- **Keywords:** comma-separated literal strings to match in commit messages
and changed-file snippets.
- **Files:** glob patterns identifying code that embodies this concept.
- **Commit verbs:** verb phrases typical of commits introducing this concept.
Example:
- Keywords: retry, backoff, tenacity, exponential, jitter
- Files: `**/http_client.py`, `**/retry_policy.*`, `**/*.transport.*`
- Commit verbs: "add retry", "handle 429", "backoff on", "wrap in tenacity"
## Deeper reading
Links to authoritative sources. Prefer:
1. Internal references: `refrepos/docs/arch-ref-lib/...`, khujta-mem vault paths
2. First-party docs: cloud provider, framework maintainer
3. Third-party: only when no first-party exists
Each link one line, no annotation bloat.Each file teaches exactly one idea. If a file grows beyond ~150 lines or introduces a second force, split it. The catalog's value comes from concepts being small enough to verify in one teach session.
A concept that can't pick a single Primary force is too broad. This is the same rule /gabe-teach enforces on lessons. If you find yourself writing "the four reasons for retries," that's four concepts.
The ## Evidence a topic touches this section exists for machine tagging. Two to five solid rules beat fifteen fuzzy ones. False positives poison tagging quality more than false negatives — when in doubt, tighten the rule.
retry-with-backoff (distributed-reliability) lists idempotency-keys as a prerequisite even if idempotency lives in multiple specializations. Follow the truth of the dependency, not the organization chart.
Every concept should either be reachable from another concept via prerequisites / related, or be a foundational root. Orphans signal the concept doesn't belong in the catalog or the taxonomy has a gap.
If refrepos/docs/arch-ref-lib/ or khujta-mem already explains something in depth, link it in ## Deeper reading. Concept files are indexes into the broader library, not copies of it.
/gabe-teach arch and Step 4b.5)The commands treat the concepts/ directory as a queryable dataset. Expected queries:
| Query | Mechanism |
|---|---|
| All concepts in a tier | Glob concepts/**/*.md, filter frontmatter tier |
| All concepts in a specialization | Glob concepts/{spec}/*.md |
| Concepts matching a tag | Glob + filter frontmatter tags contains tag |
| Prerequisites of concept X | Read X's frontmatter prerequisites array |
| Concepts that depend on X | Glob all concepts, filter those whose prerequisites contain X |
| Concepts matching a commit/file (tagging) | Read each concept's ## Evidence rules, match against the topic's commits + files |
next for the human | Intersect unverified concepts with adjacency (see below) |
/gabe-teach arch next)Three-tier fallthrough, first match wins:
pending or skipped topic in the current project's .kdbp/KNOWLEDGE.md.prerequisites are all verified in ~/.claude/gabe-arch/STATE.md, preferring concepts in specializations where the human already has momentum (≥1 verified concept in that spec).intermediate/advanced concept the human has verified without its foundational prerequisites. Surface the gap before proposing new ground./gabe-teach arch dashboard)Per specialization, computed live from STATE.md:
foundational reached: ≥60% of published foundational concepts in the spec are verifiedintermediate reached: foundational reached AND ≥50% of intermediate concepts verifiedadvanced reached: intermediate reached AND ≥40% of advanced concepts verifiedThresholds are deliberately loose for the first three months of real use; revisit once the catalog stabilizes at ~60 concepts.
/gabe-teach arch show <id>)The concept file maps into the existing 6-part lesson template:
| Lesson section | Concept file source |
|---|---|
| What changed | Not applicable for arch-mode — replaced by Concept at a glance (frontmatter name + tier + specialization) |
| Analogy | ## Analogy body (or frontmatter one_liner if brief mode) |
| Scenario | Synthesized from ## When it applies + ## When it doesn't (one before/after pair) |
| Primary force | ## Primary force body |
| Also | Top 1-2 bullets from ## Common mistakes |
| Q1, Q2 | Generated fresh per session from ## Common mistakes + ## When it doesn't via one short LLM call |
Questions are generated — not stored in the file — so the same concept can be re-taught without repeating the same quiz.
TAXONOMY.md and surface the proposal to the user before creating the concept.concepts/_schema-example.md as the starting point.## Deeper reading thin if you don't have authoritative sources yet; don't invent.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.