Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/carbeneai/forge/createclinpx skills add CarbeneAI/Forge --skill createcligit clone --depth 1 https://github.com/CarbeneAI/ForgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00070 | $0.02514 |
| Opus 5 | $0.00035 | $0.01257 |
| Sonnet 5 | $0.00014 | $0.00503 |
| Haiku 4.5 | $0.00007 | $0.00251 |
Grade A, and why
system-createcli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 355 lines — stays where its author put it; the contents beside it link to each section on GitHub.
system-createcli
Automated CLI Generation System
Generate production-ready TypeScript CLIs with comprehensive documentation, type safety, error handling, and PAI's CLI-First Architecture principles.
🎯 WORKFLOW ROUTING (SYSTEM PROMPT)
When user requests CLI creation, follow this routing:
Primary Workflow: Create New CLI
Triggers: "create CLI", "build command-line tool", "make CLI for X", "generate CLI"
Route to: workflows/create-cli.md
Action: Generate complete CLI from requirements
Extension Workflow: Add Command
Triggers: "add command to CLI", "extend CLI with", "add feature to existing CLI"
Route to: workflows/add-command.md
Action: Add new command to existing CLI
Migration Workflow: Upgrade Complexity Tier
Triggers: "upgrade CLI", "migrate to Commander", "CLI needs more complexity"
Route to: workflows/upgrade-tier.md
Action: Migrate Tier 1 → Tier 2 (manual → Commander.js)
Testing Workflow: Add Test Suite
Triggers: "add tests to CLI", "test scaffolding", "need CLI tests"
Route to: workflows/add-testing.md
Action: Generate comprehensive test suite
Distribution Workflow: Setup Publishing
Triggers: "publish CLI", "distribute CLI", "make standalone binary"
Route to: workflows/setup-distribution.md
Action: Configure npm publishing or binary distribution
🚀 WHEN TO ACTIVATE THIS SKILL
Activate when you see these patterns:
Direct Requests
- "Create a CLI for [API/service/tool]"
- "Build a command-line interface for X"
- "Make a CLI that does Y"
- "Generate a TypeScript CLI"
- "I need a CLI tool for Z"
Context Clues
- User describes repetitive API calls → Suggest CLI
- User mentions "I keep typing this command" → Suggest CLI wrapper
- User has bash script doing complex work → Suggest TypeScript CLI replacement
- User working with API that lacks official CLI → Suggest creating one
Examples
- ✅ "Create a CLI for the GitHub API"
- ✅ "Build a command-line tool to process CSV files"
- ✅ "Make a CLI for my database migrations"
- ✅ "Generate a CLI that wraps this API"
- ✅ "I need a tool like llcli but for Notion API"
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 355 lines · 70 tokens per session scan A a5f1f3642111
system-createcli is a skill published in the GitHub repository CarbeneAI/Forge (9 stars, last pushed 1mo ago), licensed MIT. It adds 70 tokens to every session and 2,514 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pentesting-everything
Guides authorized penetration testing with PentestingEverything as the source-grounded knowledge base. Use when scoping an engagement, building domain checklists, hunting a vulnerability class, choosing tools/commands, or drafting evidence-based findings from this repository's Markdown.
implementing-devsecops-security-scanning
Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for…
hunt-ato
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session…
aod-orchestrate
Multi-feature orchestration skill that bridges /aod.blueprint output to parallel wave execution. Groups synced GitHub Issues by ICE priority tier (P0/P1/P2) into sequential waves, creates Task records, spawns batch sessions via the orchestrator API, monitors completion, and reports results. Supports --issues…
security
Claude-powered SAST and SCA security scan skill. Invoked automatically as the Security Scan step (Step 7) of /aod.build (after Design Quality Gate, before Code Simplification) or standalone via /security. Analyzes all code files and dependency manifests changed on the feature branch relative to main for OWASP Top 10…
aod-foundation
Guided post-init workshop that helps new AOD Kit adopters establish product vision and design identity. Two-part flow: Part 1 (Vision) asks 5 guided questions to populate product-vision.md; Part 2 (Design) browses archetypes to generate brand files (brand.md, tokens.css, anti-patterns.md). Supports --vision and…