Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/yvzhou1111/skillforge/skillnpx skills add yvzhou1111/skillforge --skill skillgit clone --depth 1 https://github.com/yvzhou1111/skillforgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00124 | $0.01439 |
| Opus 5 | $0.00062 | $0.00720 |
| Sonnet 5 | $0.00025 | $0.00288 |
| Haiku 4.5 | $0.00012 | $0.00144 |
Grade B, and why
skillforge scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
surface the specific finding (e.g. "this skill runs `curl | sh`") and require Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
surface the specific finding (e.g. "this skill runs `curl | sh`") and require How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SkillForge
SkillForge is the intelligent dependency butler for Agent Skills. It turns a natural-language goal or a project's tech stack into a vetted, installed set of skills — with a security audit before anything touches disk.
Two ways to use it (pick whichever is available)
- MCP tools — if the SkillForge MCP server is connected, call the
skillforge_*tools directly (preferred; structured results). - CLI — if MCP is not available, run the
skillforge(aliassf) command in the terminal. Every capability is available both ways.
When to use this skill
- "Is there a skill for X" / "find a skill that does X"
- The agent needs a capability it lacks (design, testing, deploy, payments, i18n…)
- "Set up skills for this project" / "what skills should I install"
- Vet a third-party skill before installing it
- Discover, install, or manage agent skills
Pipeline
scan (tech stack) + intent (NL goal) -> plan (ranked combo) -> audit (security) -> install (per agent)
MCP tools
| Tool | Purpose |
|---|---|
skillforge_scan |
Detect a project's capability needs |
skillforge_search |
Search skills, ranked by relevance + quality |
skillforge_plan |
Recommend a skill combination (reasons + conflicts) |
skillforge_audit |
Static security audit of a skill |
skillforge_lint |
Quality-grade a skill (A–F) against authoring conventions |
skillforge_install |
Audit + install a skill into a target agent |
skillforge_list |
List installed skills from the lockfile |
CLI usage (when MCP is unavailable)
Run via npx skillforge-butler <command> or sf <command> if installed globally.
# 1. Understand the project
sf scan # detect tech stack -> capability needs
sf scan --path ./my-app --json
# 2. Search the ecosystem
sf search "playwright e2e testing"
sf search "kubernetes" --offline # built-in catalog only, no network
# 3. Plan a combination for a goal (no install)
sf plan "build a cross-border e-commerce site with payments and i18n"
sf plan "add CI and tests" --dry-run --json
# 4. ALWAYS audit before trusting a skill
sf audit catalog:react-best-practices
sf audit owner/repo/skills/their-skill # audit a GitHub skill
sf audit --dir ./local-skill # audit a local folder
# exit code 2 == blocked (high/critical risk)
# 4b. Check skill QUALITY (grade A–F)
sf lint catalog:react-best-practices
sf lint --dir ./local-skill # grade a local skill
# exit code 2 == failing grade (F)
# 5. Install one skill into a specific agent
sf install catalog:react-best-practices --agent claude-code
sf install owner/repo/skills/x --agent cursor --global
sf install owner/repo/skills/x --min-quality 75 # refuse low-quality skills
# 6. Full pipeline end-to-end (scan -> plan -> audit -> install)
sf auto "build a REST API with auth and tests" --agent claude-code
sf auto "add docker and CI" --dry-run # preview without installing
# 7. Manage installed skills
sf list # show skillforge.lock.json entries
sf update # check installed skills for upstream changes
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 127 lines · 0 tokens per session scan B 42a40950fbcf
skillforge is a skill published in the GitHub repository yvzhou1111/skillforge (2 stars, last pushed 3mo ago), licensed MIT. It adds 124 tokens to every session and 1,439 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
auth-web-cloudbase
CloudBase Web Authentication Quick Guide for frontend integration after auth-tool has already been checked. Provides concise and practical Web authentication solutions with multiple login methods and complete user management.
fix-codesign-error
Slash command that inspects a macOS signing or entitlement failure and explains the minimum fix path. Invoke explicitly with /fix-codesign-error — this skill never self-triggers.
browse-and-evaluate
Use when exploring the ai-agent-skills catalog to find, compare, and evaluate skills before installing. Always use --fields to limit output size and --dry-run before committing to an install.
specflow-use
To connect Rosetta with Grid Dynamics SpecFlow MCP; only when SpecFlow is mentioned and the MCP is installed.
loop-engineering
Shared loop-engineering reference for COG skills - the agent loop, deterministic verifiers, termination conditions, in-loop context management, and named patterns. Invoke when designing or debugging a skill that iterates (search-verify-retry, scan-until-dry, fetch-retry-gate).
telnyx-messaging-hosted-curl
Set up hosted SMS numbers, toll-free verification, and RCS messaging. Use when migrating numbers or enabling rich messaging features. This skill provides REST API (curl) examples.