Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sidcorp-co/forge/forge-testnpx skills add SidCorp-co/forge --skill forge-testgit clone --depth 1 https://github.com/SidCorp-co/forgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00078 | $0.04520 |
| Opus 5 | $0.00039 | $0.02260 |
| Sonnet 5 | $0.00016 | $0.00904 |
| Haiku 4.5 | $0.00008 | $0.00452 |
Grade A, and why
forge-test scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Browser (optional)** — if a browser-automation MCP is available, use whatever browser tools the runner exposes (auto-detected; usually surfaced as `browser_*`: navigate, click, type, snapshot/screenshot). Do not hard How it starts
The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forge Test
Automated QA agent that tests the issue's actual output against the preview or staging deployment — like a human tester would. Hits the backend API and navigates the frontend to verify acceptance criteria are met.
This is NOT a test runner (vitest/playwright). It's a manual QA replacement that uses live URLs to verify the change works end-to-end.
QA is read-only on git and on deploys. You observe and report — you never merge, push to a shared branch, revert, reset --hard, or trigger/roll back a deploy, for any reason. If the environment is broken, or baseBranch is missing code an earlier step said it merged, that IS your finding: report it with evidence and set waiting (Step 9). Do not merge the branch yourself to give yourself something to test, and never revert to "restore" an environment — from here you cannot tell your own change from an outage that predates it.
Usage
/forge-test <documentId>
Tools
- forge_issues — get issue data (acceptance criteria, plan, reopenCount)
- forge_comments — list previous comments (review/fix feedback) + post test report
- forge_config — get project config (staging URLs, test credentials)
- forge_coolify_deploy — check deployment status before testing
- Browser (optional) — if a browser-automation MCP is available, use whatever browser tools the runner exposes (auto-detected; usually surfaced as
browser_*: navigate, click, type, snapshot/screenshot). Do not hardcode a provider. If no browser MCP is available, fall back to curl/WebFetch HTML checks. - HTTP — WebFetch / Bash (curl) for API testing
Read references/test-approach.md for detailed testing patterns (API auth, browser tools, what to verify). Read references/result-format.md for report template and verdict rules. Read references/browser-playbook.md for step-by-step browser interaction guides (login, navigation, form input, code inspection) — follow these exactly to avoid rediscovering UI flows.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 230 lines · 78 tokens per session scan A 7a2b2ef25450
forge-test is a skill published in the GitHub repository SidCorp-co/forge (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 78 tokens to every session and 4,520 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ad-creative
When the user wants to generate, iterate, or scale ad creative — headlines, descriptions, primary text, or full ad variations — for any paid advertising platform. Also use when the user mentions 'ad copy variations,' 'ad creative,' 'generate headlines,' 'RSA headlines,' 'bulk ad copy,' 'ad iterations,' 'creative…
ads
When the user wants help with paid advertising campaigns on Google Ads, Meta (Facebook/Instagram), LinkedIn, Twitter/X, or other ad platforms. Also use when the user mentions 'PPC,' 'paid media,' 'ROAS,' 'CPA,' 'ad campaign,' 'retargeting,' 'audience targeting,' 'Google Ads,' 'Facebook ads,' 'LinkedIn ads,' 'ad…
adaptive-anti-bot-web-scraping
Adaptive web scraping framework with anti-bot bypass and spider crawling.
ab-testing
When the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "should I test this," "which version is better," "test…
access-gevety-health-biomarker-data
Access your Gevety health data - biomarkers, healthspan scores, biological age, supplements, activities, daily actions, 90-day health protocol, and upcoming tests.
access-exchange-2010-ews-functions
Exchange 2010 EWS integration for emails, calendar, contacts, and tasks.