Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add harshanandak/forge --skill forge-landgit clone --depth 1 https://github.com/harshanandak/forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/harshanandak/forge/forge-land)<a href="https://agentmods.dev/skills/harshanandak/forge/forge-land"><img src="https://agentmods.dev/badge/skills/harshanandak/forge/forge-land/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/harshanandak/forge/forge-land"><img src="https://agentmods.dev/badge/skills/harshanandak/forge/forge-land.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00018 | $0.01033 |
| Opus 5.5 | $0.00007 | $0.00413 |
| Sonnet 5.5 | $0.00004 | $0.00207 |
| Haiku 4.5 | $0.00002 | $0.00103 |
Grade A, and why
forge-land scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
forge-land
Orchestrator only. A worker never merges. Merge by: agent.
Merge conditions: all of them, read fresh
Preview: forge check gate --pr <n>. The merge below must return exit 0, ok:true and result.outcome MERGED. Keep result.head as <head> and result.receipt as <id>.
The gate requires an open, clean PR, a verified current-head PASS receipt covering receiptChecks, successful required CI checks, no unresolved threads across every page, and no changed file matching doorPaths. It re-reads the head before returning. REFUSED exits 1 with reasons; fix through forge-review and rerun the gate.
A matched door path always refuses: the owner merges that PR by hand. A merge that deploys, publishes or migrates is also a door (publish, force-push, prod-write, migration-apply, delete-branch, delete-worktree, merge-to-autodeploy, global-config): it needs the owner's reply naming that action. Silence, "continue" or "fix all" never counts as approval.
Merge, pinned and serial
Merge one PR at a time, after combined-code CI: minimise time to merge within floors of zero red checks, open threads and open doors.
forge pr merge <n>
It runs the gate and uses gh pr merge <n> --squash --match-head-commit <head> pinned to its head, never --admin, --auto or --delete-branch. Never run raw gh pr merge. On CHECK_GATE_REFUSED, fix result.gate.reasons through forge-review. On MERGE_UNVERIFIED, read gh pr view <n> --json state,mergeCommit,headRefOid before anything else; apply Verify 1 against the printed gate head.
A refused merge because the head moved means run the gate again. Never merge without the pin.
Verify
gh pr view <n> --json state,mergeCommit,headRefOidmust showMERGED,headRefOidequal to<head>and a validmergeCommit.oid; otherwise the merge is not verified: stop. Keep its merge commit SHA.- Base CI:
gh run list --branch <base> --commit <sha>. Wait through the harness, not a sleep loop. Red is a new bug: file at p0 or p1 and fix forward. - Close the issue. The worker released its claim, so take it again first:
forge issue claim <slice>. Runforge issue links <slice>; if the newestdeliverslink is not the PR being landed (or none exists), add the current PR URL first withforge issue link <slice> --relation delivers --url "<pr url>"while holding the claim. Then runforge issue close <slice> --reason "merged in <sha>" --receipt <id>using the gate's receipt or acheck runreceipt at the merge commit. OnRECEIPT_HEAD_MISMATCHorPR_NOT_MERGED, stop; never switch towithoutReceipt. OnUNAVAILABLE, retry. - Inspect the worktree (
git -C <path> status --shortandgit -C <path> log origin/<base>..HEAD --oneline). Remove only when both are empty; file or push anything left first. Removing work is a one-way door. - Stop watching after verify: run
forge agent wait <n> --done, do each step, then followthen. Same cleanup when abandoning or handing back the PR.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +2 lines · -39 tokens per session 2b2a1a92a520
- 2d ago First seen · 49 lines · 57 tokens per session scan A 5abf21f0c580
forge-land is a skill published in the GitHub repository harshanandak/forge (0 stars, last pushed yesterday), licensed MIT. It adds 18 tokens to every session and 1,033 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-28.
Other skills, from other repositories
batch
Research and plan a large-scale change, then execute it in parallel across 5–30 isolated worktree agents that each open a PR.
team-release
Orchestrate the release team — release-manager, qa-lead, devops-engineer, producer — to execute a release from candidate to deployment.
operating-github-cli
Default GitHub skill for the action agent. Use githubcli for any GitHub request — create/list/view/close issues and PRs, assign, labels, repos, releases, checks, github.com/owner/repo URLs, or gh api. Prefer over shellrun/!gh. Run these with githubcli in the current agent turn.
github
Drive GitHub via the official gh CLI — repos, issues, pull requests, releases, gists, Actions runs, and raw REST through gh api. Use when the user asks to inspect or manage GitHub.
testdino-releases
Use when the user wants to browse, inspect, create, or update releases/milestones in a TestDino project. Covers listreleases, getrelease, createrelease, and updaterelease. Accepts counter-style IDs like MS-12.
create-milestone
Create a GitHub milestone for an upcoming release. Suggests the next version based on the latest release, gathers all merged PRs and closed issues since that release, presents a draft with two tables (Issues and PRs) for user approval, then creates the milestone and assigns all approved items.