A workflow for copying a deployed Vibedgames project when its source code was published, then giving the copy its own project name.

It helps download a project's source, rename the copy, install and modify it locally, build it, and deploy it under a new Vibedgames address.

It avoids starting from an empty project when you want to remix an existing browser game, while keeping the new project separate from the original.

fork — Skill for Claude Code and Codex by kyh: A workflow for copying a deployed Vibedgames project when…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/kyh/vibedgames/fork

Any agent

npx skills add kyh/vibedgames --skill fork

Clone the repo

git clone --depth 1 https://github.com/kyh/vibedgames

Made for: Claude Code, Codex.

Or install tooling, the plugin that ships this one along with the rest of its 4 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/kyh/vibedgames/fork.svg)](https://agentmods.dev/skills/kyh/vibedgames/fork)

Your own site

<a href="https://agentmods.dev/skills/kyh/vibedgames/fork"><img src="https://agentmods.dev/badge/skills/kyh/vibedgames/fork.svg" alt="Measured on agentmods" height="20"></a>

Per session 95 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 951 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00095	$0.00951
Opus 5	$0.00048	$0.00476
Sonnet 5	$0.00019	$0.00190
Haiku 4.5	$0.00010	$0.00095

Measured 3d ago against content hash 6bfa0b5c764d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

fork scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

- **secrets always excluded**: `.env*`, `*.key`, `*.pem`, `id_*`, `.npmrc`, `.git-credentials`

plugins/tooling/skills/fork/SKILL.md · 89 lines

How it starts

The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Forking vibedgames projects

vg deploy --source ships the project source alongside the built bundle. Once shipped, any logged-in user can pull it down, re-slug it, and build on it — that is the remix loop. Source upload is opt-in: a plain vg deploy ships the built bundle only.

Fork an existing project

vg fork <source-slug> [new-slug]

<source-slug> — the project to fork (e.g. bomberman).
[new-slug] — directory + slug for your copy. Defaults to <source-slug>-fork.
Downloads the source archive, extracts it into ./<new-slug>/, and rewrites vibedgames.json + package.json to the new slug (clean slate — no link back to the original).
--json emits { slug, dir, forkedFrom } for agent parsing.
--force overwrites an existing target directory.

Then build on it and redeploy under your own slug:

vg fork bomberman my-bomberman
cd my-bomberman
npm install
npm run dev          # iterate
npm run build
vg deploy ./dist     # ships to my-bomberman.vibedgames.com (bundle only)

vg fork requires login (vg login, or VG_TOKEN for headless/agent use). Most projects ship no source, and fork fails on those with a clear NOT_FOUND — there's nothing to fork.

Ship source so others can fork you

Source upload is off by default. Opt in per deploy:

vg deploy ./dist --source

Do this only when the user has asked to make the project forkable. Publishing someone's source without them asking is not a default worth guessing at.

What's in the source archive

The archive is the project root (the directory containing vibedgames.json), gzipped, respecting .gitignore and a hard exclude list:

always excluded: node_modules, .git, dist/build/.next/.turbo/.cache, logs
secrets always excluded: .env*, *.key, *.pem, id_*, .npmrc, .git-credentials
plus anything your .gitignore (or a .vibedgamesignore) lists

vg deploy prints the file count + size of the source it's about to ship.

Read the full file on GitHub · 89 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 89 lines · 95 tokens per session scan C 6bfa0b5c764d

Subscribe to this mod's changes

fork is a skill published in the GitHub repository kyh/vibedgames (55 stars, last pushed 2d ago), licensed MIT. It adds 95 tokens to every session and 951 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Game development game multiplayer nextjs realtime supabase

supabase

Use when doing ANY task involving Supabase: Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues, supabase-js, @supabase/ssr, RLS, schema migrations, CLI, MCP server. Includes security checklist.

martineserios/thebrana · 58 tokens

game-development

Game development patterns, architectures, and best practices.

miles990/claude-software-skills · 12 tokens

react-hook-form

Correct React Hook Form usage anywhere in the monorepo — data flow, subscriptions, reset, dirty state, number inputs, and controlled-input rules. Load this BEFORE writing or modifying ANY form code, adding a field to an existing form, touching watch/useWatch/formState/getValues/setValue/reset, wiring a form into a…

supabase/supabase · 123 tokens

safe-sql-execution

Use whenever code will build, return, fetch, or execute SQL that runs against a user's real Postgres database — even when the request reads like an ordinary feature or bug fix and never says "security," "injection," or "SafeSqlFragment." This covers: writing or editing any pg-meta function, query builder, or endpoint…

supabase/supabase · 221 tokens

studio-e2e-tests

Write and run Playwright E2E tests for Supabase Studio (e2e/studio). Use when asked to run e2e tests, write new E2E tests, or debug flaky or failing Playwright tests. Covers running commands, avoiding race conditions, waiting strategies, selectors, helper functions, and CI vs local differences.

supabase/supabase · 74 tokens

studio-mock-api-tests

Component tests for Supabase Studio that mock API requests at the network layer with MSW. Use when writing or reviewing a component test that exercises a React Query hook or mutation, or when migrating an existing test away from vi.mock('@/data/...'). Covers the customRender + addAPIMock template and the jsdom/MSW…

supabase/supabase · 79 tokens

fork