fablize — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fablize (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Principle: a harness cannot raise a model's ceiling. It makes the model go all the way to its own ceiling — by enforcing verification, completion, and investigation as procedure. When the capability ceiling is the blocker (open-ended creative detail, self-driven discovery), escalate.
>
Apply only what the task signals (smallest matching discipline; overlap only when genuinely multi-category).
requested scope — no incidental refactors, no scope creep.
file" is not completion — "I wrote the file and ran it, and here's the output" is.
yourself writing "I will now create X" or "Next, I'll implement Y", stop and make the tool call immediately. A turn that ends with a promise and no tool call is an early stop — re-engage yourself.
modifying production config).
Decompose the task into sequential stories and complete one at a time, producing evidence as you go. Self-contained — no external system required. State persists in $HERMES_FABLIZE_DIR (default: ~/.hermes/fablize/) and survives session death; resume with goals.py status.
First-time use: See references/workflow-quickstart.md for exact copy-pasteable commands with the correct script path.
# Locate goals.py on this machine
FABLIZE_ROOT=$(find ~/.hermes -name goals.py -path "*/fablize*" 2>/dev/null | head -1)
FABLIZE_ROOT=${FABLIZE_ROOT%/scripts/goals.py}
# Create a plan
python3 "$FABLIZE_ROOT/scripts/goals.py" create --brief "<summary>" \
--goal "title::verifiable objective" --goal "title::..."
# The last goal must be a verification story
python3 "$FABLIZE_ROOT/scripts/goals.py" next # activate a story + handoff
# ... work that story only ...
python3 "$FABLIZE_ROOT/scripts/goals.py" checkpoint --id G001 --status complete --evidence "<concrete evidence>"
# The final story is a verification gate:
# --verify-cmd "<command>" --verify-evidence "<result>" are REQUIRED
python3 "$FABLIZE_ROOT/scripts/goals.py" status # first command when resumingRules:
complete requires non-empty evidence (the engine refuses empty evidence)--status blocked and report whyWhen debugging, follow this discipline (also available at references/investigation-protocol.txt):
any hypothesis.
any single one. A symptom that pattern-matches to a known failure may have a different cause.
gather that evidence by reading the relevant code paths end to end. Track your confidence per hypothesis as evidence accumulates.
what allowed that cause to produce this symptom, and whether removing only the visible trigger would leave the defect latent. A fix that makes the test pass is not necessarily a fix that removes the defect.
code. After the fix, demonstrate that the failure mode itself is gone — not merely that the triggering condition no longer occurs in this environment.
them.
For artifacts whose correctness only shows when run — HTML, SVG, games, UI, charts, animations, scripts with observable output — do not stop at writing the file. Run it in its natural execution environment and observe the actual output.
The grounding loop, before completion:
Chrome --headless --screenshot), or serve and navigate. For SVG: render to PNG. For scripts: execute and capture stdout/stderr. For animations/games: drive it far enough that motion/state actually starts.
what actually rendered — layout intact? Anything obscured? Runtime errors a static check can't see? A produced-but-unobserved screenshot is not observation.
(an overlay covering the board, a console error, a broken layout) is exactly what this loop exists to catch.
Do not re-render the same unchanged state to accumulate confidence. Re-render only after you change something.
A static parse (xmllint, node --check, HTMLParser) confirms the file is well-formed — it does not confirm the artifact looks or behaves correctly.
Pure text, prose, configuration, or plain logic with its own test suite does not need rendering — the relevant grounding is running the tests, which you already do.
Signals you have hit the model's ceiling:
These are capability, not procedure, and a harness cannot fill them.
or thinking mode, recommend increasing it.
package (symptoms, attempts, failure point, repro steps).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.