Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ForgeyClap/claude-forge --skill forge-code-reviewgit clone --depth 1 https://github.com/ForgeyClap/claude-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/forgeyclap/claude-forge/forge-code-review)<a href="https://agentmods.dev/skills/forgeyclap/claude-forge/forge-code-review"><img src="https://agentmods.dev/badge/skills/forgeyclap/claude-forge/forge-code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/forgeyclap/claude-forge/forge-code-review"><img src="https://agentmods.dev/badge/skills/forgeyclap/claude-forge/forge-code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.02131 |
| Opus 5.5 | $0.00018 | $0.00852 |
| Sonnet 5.5 | $0.00009 | $0.00426 |
| Haiku 4.5 | $0.00004 | $0.00213 |
Grade A, and why
forge-code-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
argv, and spawns the real `codex` binary directly with `spawnSync(codexBin, argv, { shell: false })`; no How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forge playbook — Code review method
Self-improvement substrate (wp-skill-evals, 2026-07-31): before applying this skill, read
learnings.md in this skill's own folder and honor its corrections. After a run that produced a
genuine correction (an owner fix, a false assumption caught, a preference stated), append it to
learnings.md with a date and real evidence — never invent a lesson that didn't happen.
Do not duplicate ECC skills — defer to: code-review-excellence (the deep per-language review
reference: React/Vue/Angular/Svelte/Rust/TypeScript/Java/PHP/Python/Django/Go/C#/Kotlin/NestJS/C/C++).
This file is the Forge-specific orchestration wrapper: the fixed review order, the severity scale, and
how a finding becomes a rework item in the Forge pipeline.
Hard rules
- Review the real diff/files directly — never review a self-report of the diff, and never approve on the strength of "tests pass" alone without reading the actual change.
- Every finding is specific and actionable (file + line/symbol + what's wrong + the fix), never a vague "looks off."
- CRITICAL/HIGH findings block completion; they are not "nice to have later."
- Feedback targets the code, not the person; explain the reasoning, don't just assert a preference.
- A review is not a rewrite-to-taste pass — flag genuine correctness/security/maintainability issues, not personal style preferences that don't match a real project convention.
Review order (fixed sequence — don't skip ahead to style)
- Correctness — does the logic actually do what it claims; are edge cases the happy path hides named, not assumed away.
- Security — secrets, injected input, auth/authz boundaries, unsafe deserialization, path traversal,
anything on the mandatory security checklist (
~/.claude/rules/ecc/common/security.md) for security-sensitive changes. - Tests — does new behavior have a real test; do existing tests still pass; is coverage of the changed logic genuine (not just line-count coverage).
- Simplicity — is this the simplest correct solution, or is there unnecessary abstraction/complexity for what the task needed (YAGNI).
- Performance — any obvious N+1 queries, unbounded loops/queries, or missing pagination/caching on a hot path.
- Style — naming, formatting, project convention consistency — reviewed last, and never blocking on its own unless it actively harms readability.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · +34 lines 7c80d53f7732
- 26d ago Changed bfaa28c7fbc4
- 28d ago Changed · +19 lines 4c7d5ac48e26
- 1mo ago First seen · 63 lines · 44 tokens per session scan A 451cb87da535
forge-code-review is a skill published in the GitHub repository ForgeyClap/claude-forge (2 stars, last pushed 21d ago), licensed MIT. It adds 44 tokens to every session and 2,131 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
validate
Use when operating as the Fabrik Validate stage agent. This skill guides final validation of an implementation, verifying requirements are met, tests pass, and the PR is ready to merge.
review
Use when operating as the Fabrik Review stage agent. This skill guides code review of an implementation, finding and fixing issues, and ensuring the PR is ready for human review.
review-comment
Use when operating as the Fabrik Review comment reviewer. This skill guides applying user decisions on review findings — fixing issues, dismissing false positives, or deferring items — then committing and pushing without signaling stage completion.
pr-comments
Triage unresolved review threads on an open PR: per thread either agree (fix, verify, push, reply, resolve) or disagree (justify with a version-matched citation). Use when asked about PR comments or told to reply and resolve.
orchestrate
Run the review lenses over a change: pick the ones the change touches, read or dispatch each, gate go/no-go on cited evidence. Use when asked for our lenses, or to plan or verify a non-trivial change.
pr
Write or draft a minimal GitHub PR title and body: a linked tracker close line plus 3 to 6 one-line bullets, nothing else. Use when running gh pr create / gh pr edit or when asked for a PR description.