forgeward

Plugin forgeward from marketplace forgeward-gate in androsland/forgeward-gate. Commands read from the repo's manifest — 24 days ago.

Skills (4)

• audit

  Run forgeward's read-only whole-repo security audit — secrets archaeology, dependency supply chain, CI/CD pipeline security, infrastructure shadow surface, webhook/API/integration audit, LLM/agentic/MCP security, skill supply chain, OWASP Top 10, STRIDE and data classification. This is the deep-audi

• ci-gate

  Detect a repo's real stack, draft the CI it's missing (test/lint/e2e AND security scanning), flag what can't yet run green, then — the part that actually protects prod — offer to make those checks required via branch protection. Drafting is advisory (files you review and commit); enforcement is one

• gate

  Run forgeward's enforced, read-only conformance gate before shipping. Detects which surfaces the diff touches (personal data, UI, LLM/paid-AI calls, public pages, dependency manifests, code security), fires only the relevant read-only reviewers, and on all-PASS writes the pass marker, then invokes g

• pentest

  Run Forgeward's opt-in runtime web-security check with OWASP ZAP and finding-specific nuclei templates. Active scans are local-only: Forgeward starts the reviewed app inside an egress-restricted Docker network and requires an explicit confirmation immediately before execution. If that envelope canno

Subagents (11)

• accessibility-reviewer

  Read-only accessibility (a11y) auditor for the forgeward gate. Fires when the diff adds or modifies UI. Audits the diff against WCAG 2.1 AA. Never modifies code.

• ai-output-reviewer

  Read-only reviewer for AI/LLM integration in the forgeward gate. Fires ONLY when the diff adds or modifies a call to an LLM or other paid-AI endpoint. Audits output reliability, eval coverage, and cost safety. Never modifies code.

• api-contract-reviewer

  Read-only API-contract reviewer for the forgeward gate. Fires when the diff touches an HTTP/RPC/GraphQL surface, a route definition, a serializer, or an OpenAPI spec. Audits breaking changes, versioning, error-shape consistency and documentation drift. Never modifies code.

• data-migration-reviewer

  Read-only database-migration reviewer for the forgeward gate. Fires when the diff adds or changes a schema migration, a backfill, or a `.sql` DDL file. Audits reversibility, data-loss risk, lock duration, backfill batching and deploy-order safety. Never modifies code.

• maintainability-reviewer

  Read-only maintainability reviewer for the forgeward gate. Fires on every diff that touches code. Audits dead code, magic numbers, stale comments, duplicated behaviour with defects, conditional side effects and module-boundary leaks. Reports debt; blocks only on dead code that is still load-bearing.

• performance-reviewer

  Read-only performance reviewer for the forgeward gate. Fires when the diff touches backend or frontend code. Audits N+1 queries, missing indexes, algorithmic complexity, pagination, bundle size and blocking async work. Never modifies code.

• privacy-reviewer

  Read-only data-privacy auditor for the forgeward gate. Fires when the diff collects, stores, logs, or transmits personal data — and ALSO on any site whose posture is `private-shareable` (no auth boundary, the URL is the credential), where adding a route, a lookup UI, an embed, or OG tags is itself a

• security-reviewer

  Read-only application-security / SAST reviewer for the forgeward gate. Fires when the diff adds or changes executable code (server handlers, DB queries, auth, file/shell/network I/O, deserialization, templates, or .sql). Runs deterministic scanners (Semgrep + two bundled rulepacks — WordPress securi

• seo-reviewer

  Read-only technical-SEO and link-preview reviewer for the forgeward gate. Fires when the diff adds or modifies pages reachable without a login — whether they are meant to be indexed (marketing, docs, content) or deliberately unindexed but shareable (share links, previews, invite-only pages). Classif

• supply-chain-reviewer

  Read-only dependency supply-chain reviewer for the forgeward gate. Fires ONLY when the diff adds or changes a dependency manifest (package.json, *.csproj/packages.lock.json, composer.json, requirements.txt, go.mod, Cargo.toml, etc.). Covers typosquatted/hallucinated packages, copyleft-license incomp

• testing-reviewer

  Read-only test-coverage reviewer for the forgeward gate. Fires on every diff that touches code or tests. Audits negative paths, edge cases, negative assertions, isolation, flakiness, security-enforcement coverage and low-value tests. Never modifies code.

Hooks (2)

• UserPromptExpansion

  "${CLAUDE_PLUGIN_ROOT}"/scripts/forgeward-gate-check.sh expansion

• PreToolUse

  "${CLAUDE_PLUGIN_ROOT}"/scripts/forgeward-gate-check.sh pretooluse

Similar plugins