forge

An agent-engineering plugin for Claude Code: twenty-five fg-* skills. fg-security audits a codebase for exploitable vulnerabilities (methodology vendored from cloudflare/security-audit-skill, MIT) with artefacts kept outside the repo, and routes severity-gated findings into fix-forward plans. fg-debug diagnoses hard bugs conversationally (vendored from mattpocock/skills' diagnosing-bugs, MIT), then stops at diagnosis. It routes by state before size: an active failed task returns to fg-run even when trivial; only independent diagnoses branch to fg-quick or an approved fix-forward plan. A red command counts as a persistent eval only when durable; raw captures stay outside the repo and every exit cleans temporary artefacts. Unattended drives always skip it (ADR 260907-140655). Three form a loop that takes one task through a single cycle of ask·plan → execute → done: ask·plan (fg-ask) is grill-with-docs-style conversational grilling, execute (fg-run) picks a task from the backlog (Run all supported) and runs it as a Dynamic Workflow, and seal (fg-done) decides the retro — writing a retro log when there is something to learn and asking once only when a promotion to docs or evals clears the bar — then seals the task and guards against re-runs, via a deterministic seal script (forge-done.sh/.js) shared by every seal path (ADR-0030). Twenty-two more sit outside the loop: fg-learn batch-promotes the learnings unattended seals deferred; fg-map maps the codebase into .forge/codebase/ with parallel subagents so grilling reads a map instead of re-exploring the code (cuts context rot); fg-quick is a lightweight lane for trivial tasks that grills lightly, logs one line to .forge/quick/LOG.md, runs directly without formal artifacts (no ADR/plan/retro), and bails to fg-ask if the task turns out non-trivial; fg-status is a read-only reporter that surveys .forge/ and prints where every task stands plus the single next step you need (writes nothing, never auto-runs); fg-next derives th

26 skills · hooks