forge-core

Data analyst — success metrics, KPIs, measurement strategies, business impact analysis, data-driven evaluation. USE WHEN metrics design, success criteria, impact analysis, data strategy.

Documentation specialist — README quality, API docs, developer experience, onboarding clarity. USE WHEN documentation review, README evaluation, developer experience assessment, onboarding analysis.

Forensic security analyst — PII detection, secret scanning, identity leak auditing across git history, staged changes, and working tree. USE WHEN PII scan, leaked name, pre-publication audit, git history audit, secret scan, security review, forensic analysis.

Product manager — requirements clarity, user goals, roadmap alignment, market fit, prioritization trade-offs. USE WHEN requirements review, feature scoping, roadmap decisions, product strategy.

Provenance and deployment integrity auditor -- validates SLSA sidecars, manifests, and drift across providers. USE WHEN check provenance, audit deployment, verify integrity, detect drift, stale files, manifest check.

Security policy architect — threat modeling, security posture, policy design, architectural risk. USE WHEN security review, threat model, security policy, architectural security assessment.

System architect — design patterns, boundaries, dependencies, scalability, long-term trade-offs. USE WHEN architecture decisions, system design, boundary analysis, scalability assessment.

Devil's advocate — stress-tests ideas, plans, proposals, and decisions. USE WHEN critical analysis, challenge assumptions, decision review, risk assessment.

Strategic web researcher — multi-query decomposition, parallel search, scholarly synthesis with citations. USE WHEN deep research, topic investigation, source analysis, evidence synthesis.

Adapt generic rules and prompts for independent repos — strip forge branding, add path scoping, drop irrelevant rules, preserve custom overrides. USE WHEN adapt rules, adapt prompts, port rules, specialize rules, sync rules, update rules for repo, rules for proton, rules for lb-agent.

Fix indentation, fence language tags, heading depth, and frontmatter fields to match forge conventions. USE WHEN an adopted community skill or any prompt-shaped document fails a forge convention check (indent, fence, heading, schema).

Find, read, create, validate, and capture Architecture Decision Records. USE WHEN ADR lookup, architecture decision, project context, decision history, create ADR, new ADR, validate ADR, capture ADRs, decisions directory, or editing any ADR file.

Bash and shell scripting pitfalls — BSD vs GNU tools, set -euo pipefail traps, glob behavior, subprocess env. USE WHEN writing or reviewing shell scripts (.sh files), Makefiles with shell recipes, or install scripts.

Collaborative ideation before implementation — explore context, clarify intent, propose approaches. USE WHEN starting creative work, new features, design decisions, or modifying behavior.

Create, validate, or audit agent definitions. USE WHEN create agent, new agent, build agent, scaffold agent, validate agent, audit agents, agent conventions, agent frontmatter.

Create and validate module hooks. USE WHEN create hook, new hook, write hook, scaffold hook, validate hook, check hook, hook conventions, hook events, hook structure.

Design, build, and validate forge modules. USE WHEN create module, new module, scaffold module, validate module, check module, audit module, module structure, module conventions, module architecture.

Create, validate, and publish Claude Code plugins from forge modules. USE WHEN create plugin, validate plugin, publish plugin, marketplace, plugin.json, cowork plugin.

Create and validate skills for forge modules. USE WHEN create skill, new skill, write skill, validate skill, check skill, skill structure, skill conventions.

Cite origins for every factual data point (number, date, limit, rate, threshold) via markdown reference-style links. USE WHEN writing docs, ADRs, READMEs, or any file that asserts factual claims.

Remove hardcoded vendor names, brand references, and external-service dependencies from a prompt-shaped document. USE WHEN an adopted skill hardcodes specific tool names, company brands, or paid service dependencies that would bias the skill toward one ecosystem.

Write a formal design spec from brainstorming output or requirements. USE WHEN design approved, write spec, formalize design, spec document.

Execute an implementation plan inline — task by task in a single session. USE WHEN executing plan, run plan, implement plan, inline execution.

Move bulk reference material from the main SKILL.md body into @-included companion files so the always-loaded content stays lean. USE WHEN an adopted or authored skill's body exceeds its information density because it inlines reference tables, pricing, catalogs, or per-variant guidance.

Adopt a community skill from an upstream URL into forge. Fetches the source, applies transforms, produces a working SKILL.md with SLSA provenance. USE WHEN adopting a community skill from aitmpl, anthropics/skills, or a similar catalog.

Build distinctive, production-grade frontend interfaces that avoid generic AI aesthetics. USE WHEN the user asks for web components, pages, landing pages, dashboards, React / HTML / CSS layouts, or styling of any web UI. Not for backend or non-UI work.

Usage and workarounds for AI-safety plugins that block destructive commands. USE WHEN a safety plugin blocks a command, safety-net error, guardrails, sandbox blocked, git reset --hard blocked, rm -rf blocked, workaround for a blocked command, safety plugin configuration.

Generate single-file HTML demos comparing techniques side-by-side. USE WHEN preview css, compare css, css demo, show options, visual comparison, html playground, render demo.

Extract session learnings and apply them as updates to rules, skills, and agents. USE WHEN session produced reusable patterns, corrections, or conventions worth capturing.

Markdown authoring and linting conventions for forge — fence tags, table alignment, link paths, reference-style labels, README language switchers, and the Linting workflow. USE WHEN editing any markdown file, or invoking lint.

Create, derive, and validate .mdschema files for markdown documents. USE WHEN create schema, add schema, derive schema, validate schema, check schema, mdschema, lint schema, heading rules, frontmatter validation, or editing any markdown file in a directory that contains a .mdschema.

Remove motivational, marketing, and filler prose from a prompt-shaped document while preserving directive content. USE WHEN adopting a community skill, authoring a skill or rule that feels bloated, or auditing an existing artifact for token waste. Applies MVPR principles.

Validate and minimize prompts — provenance, targeting, staleness, redundancy, ablation testing, perplexity scoring. USE WHEN audit rules, check provenance, minimize prompts, prompt cleanup, validate targeting, find redundant rules, prompt audit, prompt analysis, stale rules.

Audit forge module provenance and deployment integrity — inspect deployed sidecars, detect drift, clean stale artifacts after renames, trace adoption chains. USE WHEN running forge provenance, auditing a deployed target, debugging drift, cleaning up after a skill rename, or investigating sidecar state.

Provenance tracking and sync for inherited rules, skills, and agents. USE WHEN drift, sync, publish prompts, inheritance, upstream, propagate, adapt rules, check provenance.

RTK (Rust Token Killer) — token-optimized CLI proxy for Claude Code. USE WHEN rtk, token savings, optimize tokens, reduce tokens, command optimization.

Tighten a prompt-shaped document's tool scope to the narrowest set it actually uses. USE WHEN an adopted or authored skill declares allowed-tools: '*', omits the frontmatter field entirely, or grants tools the workflow never invokes.

Commit-time secret scanning with gitleaks — prevent credentials from entering git history. USE WHEN scanning for leaked secrets, setting up pre-commit hooks, or auditing repositories for credentials.

Language and framework specific security reviews for python, javascript/typescript, and go. USE WHEN the user requests a security review, secure-by-default coding help, or a vulnerability report. Not for general code review or debugging.

Audit and clean AI coding tool settings — permissions, plugins, hooks, cross-layer conflicts. USE WHEN review permissions, clean settings, audit config, plugin conflicts, hook audit, settings cruft.

Check for relevant skills before responding to a user message, including before clarifying questions. USE WHEN you are about to reply and have not verified whether a skill applies. Applies universally.

Check the forge ecosystem for staleness — installed skills vs source, binary freshness, lib consistency, version drift, submodule pointers, hook config. USE WHEN stale, freshness, out of date, check staleness, need to rebuild, make install needed, system check.

Verify work before claiming done. USE WHEN about to claim work is complete, fixed, or passing, before committing or creating PRs.

Git best practices — conventional commits, staging, push policy, repo governance. USE WHEN committing, pushing, creating PRs, branch protection, rulesets, CODEOWNERS.

Create a detailed implementation plan with bite-sized tasks. USE WHEN spec approved, plan implementation, create plan, write implementation plan.

4 hooks across 2 events