Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add atlassian/forge-skills --skill forge-app-buildergit clone --depth 1 https://github.com/atlassian/forge-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atlassian/forge-skills/forge-app-builder)<a href="https://agentmods.dev/skills/atlassian/forge-skills/forge-app-builder"><img src="https://agentmods.dev/badge/skills/atlassian/forge-skills/forge-app-builder.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.01436 |
| Opus 5 | $0.00046 | $0.00718 |
| Sonnet 5 | $0.00018 | $0.00287 |
| Haiku 4.5 | $0.00009 | $0.00144 |
Grade A, and why
forge-app-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forge App Builder
Route each request through only the branches and capability gates it needs. Keep platform facts live and keep local guidance focused on safe decisions.
Preserve these invariants
- Retrieve current official Forge guidance before committing to platform syntax, modules, APIs, scopes, limits, runtimes, packages, lifecycle status, or CLI flags.
- Register every new deployable app with
forge create; never hand-build an app identity or replace a failed creation with an unregistered scaffold. - Inspect an existing app and its repository instructions before planning or editing it. Preserve unrelated user changes.
- Never request or accept credentials in chat. Use the relevant interactive CLI or secure configuration flow.
- Never accept Forge terms or billing consent, deploy, install, upgrade, promote, set a production variable, or change a live site without explicit authorization and a confirmed target.
- Validate every manifest change against the exact current reference and with
forge lint. - Use least privilege and avoid unnecessary egress, privileged backend operations, and migrations.
- Prefix Forge CLI commands run for this skill with
ATL_FORGE_ATTRIBUTION_SKILL_NAME=forge-app-builder; exclude user-runforge loginandforge tunnel.
Route the primary intent
Choose one primary route before loading implementation guidance:
| Intent | Route |
|---|---|
| Architecture, feasibility, or implementation plan only | Read references/plan-only.md; stop before mutations |
| Create a deployable app | Read references/create-new-app.md |
| Add or change behavior in an existing app | Read references/extend-existing-app.md |
| Known error, failed command, blank UI, logs, or unexpected behavior | Route to forge-debugger |
| Broad pre-deploy or release-readiness review | Route to forge-app-review |
| Deep security review or static analysis | Route to forge-security-review |
| Cost or platform-consumption optimization | Route to forge-cost-optimizer |
| Teamwork Graph connector | Route to forge-connector |
What ships with it
33 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .gitignore 152 B
- agents/openai.yaml 502 B
- evals/evals.json 11 KB
- evals/fixtures/existing-ui-kit-app/manifest.yml 418 B
- evals/fixtures/existing-ui-kit-app/package.json 269 B
- evals/fixtures/existing-ui-kit-app/src/frontend.jsx 364 B
- evals/fixtures/existing-ui-kit-app/src/index.js 189 B runs code
- package-lock.json 2.1 KB
- package.json 62 B
- README.md 1.8 KB
- references/apis-permissions-and-egress.md 1.7 KB
- references/backend-and-events.md 1.4 KB
- references/create-new-app.md 3.8 KB
- references/custom-ui.md 1.4 KB
- references/distribution-and-access.md 1.3 KB
- references/documentation-routing.md 2.6 KB
- references/environments-and-configuration.md 1.4 KB
- references/extend-existing-app.md 1.2 KB
- references/module-selection.md 894 B
- references/plan-only.md 769 B
- references/storage-and-residency.md 1.4 KB
- references/ui-kit.md 1.0 KB
- references/validation-and-release.md 2.9 KB
- scripts/__init__.py 93 B runs code
- scripts/create_forge_app.py 9.4 KB runs code
- scripts/deploy_forge_app.py 13 KB runs code
- scripts/forge_env.py 2.4 KB runs code
- scripts/list_templates.py 6.0 KB runs code
- tests/__init__.py 0 B runs code
- tests/test_create_forge_app.py 10 KB runs code
- tests/test_deploy_forge_app.py 7.5 KB runs code
- tests/test_forge_env.py 3.0 KB runs code
- tests/test_list_templates.py 6.4 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 80 lines · 91 tokens per session scan A 3cac8fd0028e
forge-app-builder is a skill published in the GitHub repository atlassian/forge-skills (21 stars, last pushed yesterday), licensed Apache-2.0. It adds 91 tokens to every session and 1,436 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
motherduck-build-cfa-app
Build MotherDuck analytics into customer-facing applications with tenant isolation, backend routing, and serving APIs.
motherduck-connect
Set up or troubleshoot MotherDuck connections, authentication, client runtimes, and read scaling.
motherduck-rest-api
Administer MotherDuck service accounts, tokens, Ducklings, and Dive embed sessions through the control-plane REST API.
add-server-logic
Creates, edits, and manages Power Pages Server Logic files — server-side JavaScript that runs securely on the Power Pages runtime. Orchestrates the full lifecycle: gathering requirements, fetching documentation, implementing code, configuring site settings, and deploying. Use when the user wants to add server-side…
add-cloud-flow
Integrates Power Automate cloud flows into a Power Pages site. Lists available flows, suggests relevant ones based on intent, identifies scenarios and web roles, creates metadata files, and generates client-side code to call flows. Handles both new flow registration and adding already-registered flows to additional…
integrate-backend
Analyzes the user's business problem and recommends the right backend integration approach — Web API, AI Web API (generative summaries / grounded search), Server Logic, Cloud Flows, or a combination — for a Power Pages site, then routes to the appropriate specialized skill. Use when the user wants to add backend…