Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add tomthebearded/guide-forgenpx agentmods add plugins/tomthebearded/guide-forge/marketplacegit clone --depth 1 https://github.com/tomthebearded/guide-forgeGrade A, and why
guide-forge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "guide-forge",
"owner": { "name": "tomthebearded", "url": "https://github.com/tomthebearded" },
"metadata": {
"description": "The GuideForge plugin — learn-as-you-go guide authoring for Claude Code."
},
"plugins": [
{
"name": "guide-forge",
"source": "./",
"description": "Plan, draft, clarify, review, modernize, audit, scaffold, version-update, amend-mid-flight, track-progress, check-executed-work, fix-from-field-reports, and log-reader-feedback learn-as-you-go developer guides, plus a pre-PR contributor check. Fourteen skills, one install."
}
]
}
What ships with it
1 file beside marketplace.json in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 15 lines scan A 6b3cda9b0f51
guide-forge is a plugin published in the GitHub repository tomthebearded/guide-forge (3 stars, last pushed 11d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
simple-output-styles
Output styles that make Claude write clearly, for everyone.
documentation-review
Comprehensive documentation management: review, create, update, and maintain high-quality documentation with Diataxis framework support.
shadow-tutor
Shadow Tutor — a post-session programming tutor: it makes you predict why the AI made its one load-bearing decision before it reveals, then teaches the why on your own code.
shadow-tutor
A post-session programming tutor that runs as an in-session Codex/Claude Code skill. After an AI-assisted coding session it picks the one load-bearing decision you most likely don't truly understand, makes you predict why before it reveals, then teaches the why on your own code — fighting the skill atrophy that AI…
codebase-mooc-marketplace
Codebase MOOC — AI-generated engineering education embedded in your codebase.
codebase-mooc
AI-generated engineering education embedded in your codebase. Takes any developer from novice to owner without going anywhere else.