Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/sangrokjung/claude-forge/forge-updategit clone --depth 1 https://github.com/sangrokjung/claude-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sangrokjung/claude-forge/forge-update)<a href="https://agentmods.dev/commands/sangrokjung/claude-forge/forge-update"><img src="https://agentmods.dev/badge/commands/sangrokjung/claude-forge/forge-update.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00015 | $0.02404 |
| Opus 5 | $0.00008 | $0.01202 |
| Sonnet 5 | $0.00003 | $0.00481 |
| Haiku 4.5 | $0.00002 | $0.00240 |
Grade D, and why
forge-update scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 "$FORGE_META" Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cp "$REPO_PATH/settings.json" "$HOME/.claude/settings.json" Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$HOME/.claude/${dir}.old" How it starts
The opening of the file, as written. The whole thing — 332 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/forge-update - Claude Forge 자체 업데이트
플래그
| 플래그 | 설명 |
|---|---|
--check-only |
업데이트 확인만, 실제 pull하지 않음 |
--force |
로컬 변경사항이 있어도 stash 후 강제 진행 |
| (없음) | 업데이트 확인 + pull + 후처리 |
1단계: 메타파일 로드
FORGE_META="$HOME/.claude/.forge-meta.json"
메타파일이 있으면:
REPO_PATH=$(jq -r '.repo_path' "$FORGE_META")
INSTALL_MODE=$(jq -r '.install_mode' "$FORGE_META")
CURRENT_VERSION=$(jq -r '.version' "$FORGE_META")
CURRENT_COMMIT=$(jq -r '.git_commit' "$FORGE_META")
메타파일이 없으면 (이전 버전 설치):
# symlink에서 저장소 경로 추론
REPO_PATH=$(cd -P "$(readlink "$HOME/.claude/agents")" 2>/dev/null && cd .. && pwd)
추론도 실패하면 에러:
Claude Forge 저장소를 찾을 수 없습니다.
다시 clone 후 install.sh를 실행하세요:
git clone https://github.com/sangrokjung/claude-forge.git
cd claude-forge && ./install.sh
2단계: 저장소 검증 (CRITICAL - 보안)
repo_path를 신뢰하기 전에 반드시 검증한다.
# 1. 경로 정규화 (심링크 해제)
REPO_PATH=$(cd "$REPO_PATH" 2>/dev/null && pwd -P)
# 2. .git 디렉토리 존재 확인
ls -d "$REPO_PATH/.git"
# 3. claude-forge 저장소인지 특징 파일로 검증
ls "$REPO_PATH/.claude-plugin/plugin.json"
# 4. remote URL이 claude-forge인지 확인
REMOTE_URL=$(cd "$REPO_PATH" && git remote get-url origin 2>/dev/null)
echo "$REMOTE_URL" | grep -q 'claude-forge'
검증 실패 시:
저장소 경로가 유효하지 않거나 claude-forge 저장소가 아닙니다: {REPO_PATH}
다시 clone 후 install.sh를 실행하세요.
3단계: 로컬 변경사항 체크
cd "$REPO_PATH"
git status --porcelain
변경사항이 있으면:
--force없음: 경고 메시지 출력 + 중단로컬 변경사항이 있습니다: {변경 파일 목록} --force 플래그로 stash 후 진행하거나, 수동으로 정리해주세요.--force있음:git stash실행 후 진행
4단계: 원격 fetch + 기본 브랜치 감지
git fetch origin
실패 시 (네트워크 오류):
원격 저장소에 연결할 수 없습니다.
네트워크 연결을 확인하세요.
기본 브랜치 동적 감지:
DEFAULT_BRANCH=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||')
if [ -z "$DEFAULT_BRANCH" ]; then
DEFAULT_BRANCH="main"
fi
5단계: 버전 비교
LOCAL_HEAD=$(git rev-parse HEAD)
REMOTE_HEAD=$(git rev-parse "origin/$DEFAULT_BRANCH")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 332 lines · 15 tokens per session scan D d6f3a19aa051
forge-update is a command published in the GitHub repository sangrokjung/claude-forge (824 stars, last pushed 2d ago), licensed MIT. It adds 15 tokens to every session and 2,404 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
release
Prepare and publish a new release of VisionAgent to npm.
release
Review and publish the Release Please release PR, then verify every registry.
changeset
../../.mastracode/commands/changeset.md.
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary — the complete landing pipeline.
update-changelog-and-tag
You are preparing a release. Follow these steps precisely.
release-harn
Run the tag-first Harn release workflow.