gabe-roast — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited gabe-roast (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Stress-test a target (file, folder, plan, architecture, or concept) from a specific perspective to surface gaps, risks, and missing pieces — classified by software maturity level and importance, with actionable output that drives decisions.
This skill does not produce generic checklists. It adopts a perspective, reads deeply, and attacks like someone whose job depends on finding what's wrong.
Rendering note. Output templates in this spec wrapped in bare triple-backtick fences are spec-meta delimiters — render their contents as plain markdown at runtime so gap tables and severity classifications display as tables. See gabe-docs/SKILL.md § "Runtime output rendering convention".Every roast requires two inputs. If either is missing, ask before proceeding.
| Input Type | Example |
|---|---|
| File | /docs/architecture/PROP-001.md |
| Folder | /src/services/ (roasts the system implied by the files) |
| Inline | A plan, concept, or design described in conversation |
| Context | "this conversation" or "what we just discussed" |
When the target is a file or folder, read it fully before starting. For folders, read enough files to understand the system (entry points, core logic, configuration).
The perspective is never optional. Always require it. Examples:
| Perspective | What they look for |
|---|---|
| Architect | Structural flaws, coupling, scalability bottlenecks, missing abstractions |
| UX/UI Designer | Flow gaps, inconsistency, accessibility, information architecture |
| Security Auditor | Attack surfaces, auth gaps, data exposure, injection vectors |
| QA/Testing Lead | Untestable code, missing edge cases, flaky assumptions |
| DevOps Engineer | Deployment gaps, monitoring blind spots, recovery failures |
| Domain Expert | Business logic errors, domain model gaps, real-world mismatches |
| End User | Confusing flows, dead ends, broken expectations |
The reviewer adopts the perspective fully — think like that person, worry about what they worry about, catch what they would catch.
These levels apply to ANY artifact — code, designs, plans, workflows, processes. They are not limited to software.
| Level | Prefix | Meaning |
|---|---|---|
| MVP | M | Must fix before first use — first users, first presentation, first deployment |
| Enterprise | E | Must fix before real conditions — organizations, real load, paying customers |
| Scale | S | Must fix before 10x growth — multi-region, compliance, large teams |
| Level | Indicator | Meaning |
|---|---|---|
| Critical | CRITICAL | System breaks, data loss, security hole, or blocked launch |
| High | HIGH | Major degradation, user trust erosion, expensive rework later |
| Medium | MEDIUM | Friction, tech debt accumulation, missed opportunity |
| Low | LOW | Polish, best practice, future-proofing |
Within the same maturity + importance bucket, order gaps by impact — the most damaging gap comes first.
| Field | Required | Description |
|---|---|---|
| Gap ID | Yes | Prefixed by maturity level: M1, M2... E1, E2... S1, S2... |
| Gap | Yes | What's missing or broken. 2-3 sentences. Concrete, not vague. |
| One-liner | Yes | A Gabe Lens handle — a memorable phrase (5-12 words) that captures the essence of THIS gap. Must survive fatigue and re-anchor the issue without re-reading the description. Concrete, not abstract. |
| Effort | Yes | T-shirt size (S / M / L / XL) with confidence: M (confident) or L (uncertain — depends on existing auth layer). Never false-precision story points without codebase knowledge. |
| What we lose | Yes | The specific consequence of inaction. Not generic ("tech debt") — concrete ("first user with two accounts overwrites their own data"). |
| Suggested fix | Optional | A concrete recommendation. 1-3 sentences. Include file/component references when the target is code. Skip only when the fix is obvious from the gap description. |
The one-liner follows Gabe Lens format:
GABE ROAST: [Target Name]
Perspective: [Perspective]
═══ MVP ════════════════════════════════════════════════
CRITICAL
M1
**Gap:** [What's missing or broken — 2-3 sentences]
**One-liner:** "[memorable handle]"
**Effort:** [size] ([confidence])
**Lose:** [specific consequence of inaction]
**Fix:** [concrete recommendation — optional]
M2
**Gap:** [description]
**One-liner:** "[handle]"
**Effort:** [size] ([confidence])
**Lose:** [consequence]
HIGH
M3
**Gap:** [description]
**One-liner:** "[handle]"
**Effort:** [size] ([confidence])
**Lose:** [consequence]
**Fix:** [suggestion]
MEDIUM
M4
...
LOW
M5
...
═══ ENTERPRISE ═════════════════════════════════════════
CRITICAL
E1
...
═══ SCALE ══════════════════════════════════════════════
HIGH
S1
...
────────────────────────────────────────────────────────
TOTAL: [X] gaps — [Y] critical, [Z] high, [W] medium, [V] low
Effort estimate: [range] ([overall confidence note])Brief mode produces a scannable table. All fields compressed to one line each.
GABE ROAST (brief): [Target Name] — [Perspective]
| ID | Maturity | Importance | Gap | One-liner | Effort |
|----|----------|------------|-----|-----------|--------|
| M1 | MVP | Critical | [short description] | "[handle]" | S |
| M2 | MVP | High | [short description] | "[handle]" | M |
| E1 | Enterprise | Critical | [short description] | "[handle]" | L |
| E2 | Enterprise | Medium | [short description] | "[handle]" | S |
| S1 | Scale | High | [short description] | "[handle]" | XL |
TOTAL: [X] gaps — [Y] critical, [Z] high/gabe-align shallow on the target (core values A1-A3 + project values). If all PASS: proceed. If CONCERN: print warning, proceed. If FAIL: print warning + "Foundational alignment issue. Consider /gabe-align standard. Proceed? [y/n]". Skip this gate if no .kdbp/VALUES.md or ~/.kdbp/VALUES.md exists./api/checkout endpoint catches all exceptions with a generic 500, hiding payment failures from the user and from monitoring" is a gap.The most effective pattern is roasting the same target from multiple perspectives in sequence (e.g., architect → UX designer → domain expert). When performing a follow-up roast on the same target:
Use Gabe Roast for:
Don't use Gabe Roast for:
GABE ROAST: MOCKUP-PLAN.md
Perspective: UX Designer
═══ MVP ════════════════════════════════════════════════
CRITICAL
M1
**Gap:** The plan starts with 12 isolated screen mockups but
defines no user flow diagrams. Without flows, each screen is
designed in a vacuum — transitions, data handoffs, and
navigation paths are undefined.
**One-liner:** "Building rooms before drawing the hallways"
**Effort:** M (confident)
**Lose:** Every screen gets reworked once flows reveal they
don't connect.
**Fix:** Add a Phase 0 that maps the 5 primary user journeys
before any screen work begins.
HIGH
M2
**Gap:** Component library is extracted BEFORE screens exist.
Designers can't extract reusable components from screens they
haven't made yet — the components will be hypothetical, not
battle-tested.
**One-liner:** "Packing a suitcase before knowing the destination"
**Effort:** S (confident)
**Lose:** Component library gets rebuilt from scratch once real
screens reveal actual patterns.
**Fix:** Reverse order — screens first (Phase 2), component
extraction at a checkpoint after.
═══ ENTERPRISE ═════════════════════════════════════════
MEDIUM
E1
**Gap:** No interaction specification template. Mockups show
static layouts but gesture behaviors (swipe, long-press,
pull-to-refresh), transition animations, and loading states
are unspecified.
**One-liner:** "A blueprint with no doors marked"
**Effort:** S (confident)
**Lose:** Developers implement inconsistent interactions across
screens; QA has no spec to test against.
**Fix:** Add an Interaction Notes section to each mockup template.
────────────────────────────────────────────────────────
TOTAL: 3 gaps — 1 critical, 1 high, 1 medium
Effort estimate: S-M range (confident — scope is documentation, not code)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.