A senior-trap playbook for AI coding agents. Risk categories, production checklists, and hooks for auth, billing, webhooks, identity, and database safety. Built on Claude Code, complementary to Superpowers.
SaferSkills independently audited ai-native-foundation (Agent Skill) and scored it 83/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 4 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 4 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill installs the "Junior dev + PM × AI Senior Tech Lead" framework into the user's Claude Code setup. It can do a fresh install or augment an existing setup.
Important: This skill writes to the user's ~/.claude/ directory. If files exist, it does NOT OVERWRITE - it backs them up and offers a merge. The user approves at every step.which claude)~/.claude/ exist?~/.claude/CLAUDE.md, ~/.claude/hooks/*, ~/.claude/skills/*, ~/.claude/settings.jsonIf existing files are found, ask:
"Detected an existing setup. Found: [list]. Should I back up and add alongside (recommended), or review and merge manually?"
Questions (one per turn):
{{user_name}} placeholder replacement)(Note: no "areas" question - all 9 architectural skills are installed by default; they're stack-agnostic patterns.)
Copy templates/CLAUDE.md to ~/.claude/CLAUDE.md. Replace placeholders:
{{user_name}} → user's name{{primary_role}} → selected roleIf the file exists: backup (~/.claude/CLAUDE.md.backup-YYYY-MM-DD), write the new one, present a merge strategy.
templates/hooks/* → ~/.claude/hooks/. Then:
chmod +x ~/.claude/hooks/pre_tool_use.sh
chmod +x ~/.claude/hooks/post_tool_use.sh
chmod +x ~/.claude/hooks/test_suite.shRun the test suite:
~/.claude/hooks/test_suite.shIf the test suite passes → continue. If it reports issues → show logs to the user and propose a fix.
Copy templates/settings.json to ~/.claude/settings.json. If existing: don't delete - JSON merge.
Critical block:
"hooks": {
"PreToolUse": [
{"matcher": "Bash", "hooks": [{"type": "command", "command": "~/.claude/hooks/pre_tool_use.sh"}]}
]
}Copy examples/senior-traps.md to ~/.claude/SENIOR-TRAPS.md.
Tell the user:
"This is a sample architectural trap catalog. Add traps you encounter (cross-project lesson transfer). Format in docs/customization.md."Architectural skills are stack-agnostic patterns; install all of them:
mkdir -p ~/.claude/skills
cp examples/skills/framing-product-decisions.md ~/.claude/skills/
cp examples/skills/categorizing-decisions.md ~/.claude/skills/
cp examples/skills/collaborating-with-ai-agent.md ~/.claude/skills/
cp examples/skills/designing-webhook-handlers.md ~/.claude/skills/
cp examples/skills/coordinating-multi-source-identity.md ~/.claude/skills/
cp examples/skills/designing-atomic-transactions.md ~/.claude/skills/
cp examples/skills/defending-in-depth.md ~/.claude/skills/
cp examples/skills/recording-decisions-to-evolution-log.md ~/.claude/skills/
cp examples/skills/adding-trap-to-catalog.md ~/.claude/skills/Tell the user:
"These 9 architectural skills install by default. They cover product framing, decision categorization, AI collaboration, three implementation domains (webhooks, identity, transactions), 5-layer code review (defending-in-depth), and two memory-hygiene skills (recording-decisions-to-evolution-log + adding-trap-to-catalog) that auto-write to your working-style.md and trap catalog. All stack-agnostic. Skill authoring guide: templates/skills/README.md."Copy templates/working-style.md into the user's project directory (default: <cwd>/docs/working-style.md).
Replace placeholders + tell the user:
"This manifesto is a living doc - anything that changes in the system should also be updated here. Use the Evolution log to read decisions back."
Memory is automatic. Claude Code creates session-based memory in ~/.claude/projects/<cwd-encoded>/memory/. Explain:
"Memory is automatic - built on Claude Code's native cross-session memory. Decisions, feedback, project state from new sessions persist in the background. No manual intervention - only when you say 'remember this'."
If the user said yes:
templates/obsidian-CLAUDE.md to the vault root01-Projects/, 02-Areas/, 03-Resources/, 04-Archive/, _MOC/, raw/Detail: docs/obsidian-setup.md.
Ask the user a test question:
"Now open a new terminal, start Claude Code, and write: 'Let's brainstorm a new feature: pushing notifications to users.' If the framework installed correctly, Claude should auto-invoke superpowers:brainstorming."If the test fails: troubleshoot (CLAUDE.md auto-trigger patterns, plugin enable check).
✅ AI Native Foundation installed
Loaded:
- ~/.claude/CLAUDE.md (operational rules)
- ~/.claude/SENIOR-TRAPS.md (sample architectural trap catalog)
- ~/.claude/skills/ (9 architectural skills)
- ~/.claude/hooks/ (security guardrails, test suite ran)
- ~/.claude/settings.json (permissions + hook reg)
- <cwd>/docs/working-style.md (manifesto)
- [obsidian setup if selected]
Next steps:
1. Read `docs/philosophy.md` - why this framework
2. Read `docs/customization.md` - how to tune the rules
3. Start your first task - framework is active
Issues: GitHub issuesMatch the user's language and tone. Default English; if the user writes in another language, follow.
Before each file write, present summary + ask:
"~/.claude/CLAUDE.md will be written - operational rules, ~10KB. Existing file will be backed up. Continue?"On Bash errors:
chmodNever delete. Always backup and write alongside. The user decides via manual review.
After the skill finishes, redirect the user to:
docs/philosophy.md - philosophydocs/decision-types.md - 🔴/🟡/🟢 systemdocs/customization.md - tunedocs/obsidian-setup.md - vault detailexamples/skills/* - architectural skillsexamples/senior-traps.md - trap catalogThis skill runs once. After install, return to normal Claude Code flow.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.