Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/forgeyclap/claude-forge/forge-paymentsnpx skills add ForgeyClap/claude-forge --skill forge-paymentsgit clone --depth 1 https://github.com/ForgeyClap/claude-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/forgeyclap/claude-forge/forge-payments)<a href="https://agentmods.dev/skills/forgeyclap/claude-forge/forge-payments"><img src="https://agentmods.dev/badge/skills/forgeyclap/claude-forge/forge-payments.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.01438 |
| Opus 5 | $0.00025 | $0.00719 |
| Sonnet 5 | $0.00010 | $0.00288 |
| Haiku 4.5 | $0.00005 | $0.00144 |
Grade A, and why
forge-payments scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 44 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forge playbook — Payments / checkout / billing
This is a money + secrets + PCI-scope domain. The payment-integration specialist (.claude/agents/payment-integration.md) leads the payment-specific work under Integration Boss or Build Boss. security-reviewer / codex-reviewer are useful (optional) advisors — payments is exactly the "high-risk" case where Codex-on-request earns its keep. Never claim PCI compliance or a working live charge that wasn't verified in the sandbox.
Hard rules (non-negotiable)
- No raw PAN, ever. Card data is captured by the gateway's tokenization / hosted fields / hosted checkout (Stripe Elements or Checkout, Mollie/Adyen hosted, PayPal SDK) — the raw card number, CVV, and full track data never touch your server, logs, DB, memory files, or the repo. This keeps you in PCI DSS v4.0.1 SAQ A / SAQ A-EP scope instead of full SAQ D. (SAQ A eligibility now also requires confirming the payment page is not susceptible to script-injection tampering — see Domain gates.)
- Integer minor units only. All money is integer minor units (cents) + an explicit ISO-4217 currency code. No floating-point money math anywhere — not in totals, tax, discounts, or display conversion. Round at defined boundaries only.
- Idempotency-key per charge (send side). Every create-charge / create-payment-intent / refund call carries a client-generated
Idempotency-Keyso a network retry, double-tap, or gateway timeout never double-charges. Keys are deterministic per logical operation and stored. - Signature-verified webhooks (receive side). Every inbound gateway webhook verifies the provider HMAC signature against the raw request body (Stripe
Stripe-Signature/construct_event, Mollie fetch-by-id re-check, Adyen HMAC) before acting. Reject on failure. Then dedupe onevent.idwith a UNIQUE constraint, return2xxfast (before heavy logic — Stripe fails a delivery after ~10s and retries for up to 3 days), and process the effect in a background/idempotent path. Tolerate duplicate and out-of-order events. - Test vs live separation. Test/sandbox keys are clearly separated from live; no live charge and no live-key touch without explicit owner approval (Forge honesty + irreversible-action rule). Real money is an owner-gated action, never autonomous.
- Secrets in env +
.env.exampleplaceholders. No gateway secret, webhook signing secret, or API key in code, logs, error messages, or git.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 44 lines · 50 tokens per session scan A b00b86b26334
forge-payments is a skill published in the GitHub repository ForgeyClap/claude-forge (2 stars, last pushed 1mo ago), licensed MIT. It adds 50 tokens to every session and 1,438 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
deck-pitch
10 页融资 deck, 白底 + 蓝紫渐变 hero, traction 柱状, $X.XM ask.
finance-report
Masthead + KPI + 收入/烧钱图 + P&L 表 + 重点 + 展望.
invoice
标准发票: 寄件/收件 + 明细 + 税 + 总额 + 付款指引.
business-design
Read financials, map competitive landscapes, and argue design decisions in the language of value. Use when defending design to commercial stakeholders. For the live negotiation itself, use design-negotiation (designer-toolkit).
expense-report
Summarizes and validates company expense reports against the corporate travel & meal policy, including per-meal spending caps. Use this skill whenever the user asks about expense-report policy limits, whether a specific expense complies with policy, or asks you to compute the overage amount for a meal expense.
stock-analysis
Analyze stocks and cryptocurrencies using Yahoo Finance data. Supports portfolio management, watchlists with alerts, dividend analysis, 8-dimension stock scoring, viral trend detection (Hot Scanner), and rumor/early signal detection. Use for stock analysis, portfolio tracking, earnings reactions, crypto monitoring…