S

SkillForge

Universal package manager, security auditor, and context token profiler for port

gintingism/skillforge · v0.4.2 · Development & Workflow

by gintingismOwner verifiedScan grade: GoodAwesome AI Plugins

Universal package manager, security auditor, and context token profiler for portable agent skills

Follow1
Protect this install with HOL Guard

Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.

Is SkillForge a fit?

From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.

Works with

  • Standalone
  • 26 skills
  • 1 MCP server

Before you install

Sign-in
Not declared
Declared access
Read
License
MIT

Check before relying on it

What is SkillForge?

SkillForge is a published development & workflow plugin for AI coding agents in the Standalone ecosystem, developed by gintingism and distributed through the HOL AI plugin registry. Universal package manager, security auditor, and context token profiler for portable agent skills.

Canonical slug
gintingism/skillforge
Version
v0.4.2 · updated Nov 4, 2026

Registry snapshot

Owner verification
Verified on HOL as @gintingism
Marketplace source
.claude-plugin/marketplace.json
Scanner
HOL plugin scanner
Security result
Needs review
Digest verified
Yes
26 bundled skillsRead, copy or download each SKILL.mdOpen skills

Trust and security

Trust & reputation

On-Chain Verified
83

HOL Trust Score

Per-metric points (0–100 each) combined via a weighted average into the overall score.

Installability
52/100
Maintenance
90/100
MCP server setup
100/100
Plugin Security
81/100
Provenance
80/100
Publisher Quality
100/100

Provenance

Plugin root
.
Source repo
https://github.com/gintingism/skillforge
Source commit
d016fadaaaef…
Publisher verified
Yes
Owner verified
@gintingism
Agent Plugins 1.0
Ready (structural check)

Continuous scanner CI detected

No action is required. This plugin receives the full trust score.

README badge detected

The source repository README links to this HOL listing. Distribution, not security evidence. It adds a 2% engagement adjustment to the overall trust score and never changes the security result.

Needs review
Security result
81
Security score
0
High findings
Provider
codex-plugin-scanner
Grade
B · Good
Version
3.24.2
codex:hol-plugin-scanner-6ehrTb / cisco-skill-scanner: failedcodex:hol-plugin-scanner-6ehrTb / cisco-mcp-scanner: skipped

[claude:.] Claude Plugin

18/18

5 checks

[claude:.] Security

16/16

6 checks

[claude:.] Operational Security

3/6

5 checks

[claude:.] Code Quality

10/10

2 checks

[codex:.] Manifest Validation

28/31

9 checks

[codex:.] Security

16/16

9 checks

[codex:.] Operational Security

3/6

5 checks

[codex:.] Best Practices

9/12

5 checks

[codex:.] Marketplace

0/15

3 checks

[codex:.] Skill Security

5/5

4 checks

[codex:.] Code Quality

10/10

2 checks

Published advisories

None matched in GitHub security advisories, checked . This covers published advisories only, not problems nobody has reported.

GitHub security advisories are those the source repository has published.

Findings

mediummarketplaceMARKETPLACE_SOURCE_MISSING

plugin[0] in marketplace.json is missing a "source" object.

Add a "source" object with "source" and "path" fields for each marketplace entry.

mediummarketplaceMARKETPLACE_POLICY_FIELDS_MISSING

plugin[0]: missing policy.installation

Add policy.installation, policy.authentication, and category for each marketplace entry.

mediummarketplaceMARKETPLACE_POLICY_FIELDS_MISSING

plugin[0]: missing policy.authentication

Add policy.installation, policy.authentication, and category for each marketplace entry.

mediummarketplaceMARKETPLACE_UNSAFE_SOURCE

The marketplace source "plugin[0]=missing "source.path"" is absolute or resolves outside the plugin directory.

Use relative in-repo paths that stay within the plugin directory.

lowoperational-securityDEPENDABOT_MISSINGReported 2 times

Automation or dependency surfaces exist, but .github/dependabot.yml is missing.

Add Dependabot updates for GitHub Actions and dependency manifests.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON

The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.

Update "composerIcon" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO

The interface field "logo" must use HTTPS or point to a safe in-repo asset.

Update "logo" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS

The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.

Update "screenshots" to use HTTPS or an existing relative asset path.

infobest-practicesCODEXIGNORE_MISSING

A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.

Add a .codexignore file with generated assets, local state, and secret paths.

Install guidance

Install in Source

Install from a native release archive or the assessed source revision.

Install guide
  1. 1

    Download the release archive

    Use a published GitHub release archive. The catalog version is the package version at the assessed commit.

    shell
  2. 2

    Follow the publisher install guide

    https://github.com/gintingism/skillforge/blob/d016fadaaaef01df099dbe178850d334f431bc94/docs/INSTALL.md

Did setup work in Source?

No setup reports for Source yet. Self-reported by signed-in visitors. Copying a command is not counted, and most installs are never reported.

Attested installs: Fewer than 10 attested installs of this plugin in week 2026-W44, so no number is shown. Counted from opt-in HOL Guard install reports, once per machine and runtime, and never mixed with the answers above. How install reports work.

Skillforge launch cover
1 / 4

Skillforge launch cover

Full size
Loading reviews

Plugin manifest

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "skillforge",
  "version": "0.4.2",
  "description": "Universal package manager, security auditor, and context token profiler for portable agent skills.",
  "homepage": "https://github.com/gintingism/skillforge",
  "repository": "https://github.com/gintingism/skillforge",
  "author": {
    "name": "gintingism",
    "url": "https://github.com/gintingism"
  },
  "license": "MIT",
  "keywords": [
    "agent-skills",
    "security-auditor",
    "context-profiler",
    "package-manager",
    "claude-code",
    "cursor",
    "antigravity",
    "windsurf",
    "mcp"
  ],
  "interface": {
    "displayName": "SkillForge",
    "developerName": "gintingism",
    "shortDescription": "Universal package manager, security auditor, and context token profiler for portable agent skills.",
    "longDescription": "SkillForge is the universal package manager, security auditor, and context token profiler for portable AI agent skills (SKILL.md). It audits skills for prompt injections and hidden unicode, profiles turn-by-turn context token consumption, and synchronizes skills across Claude Code, Cursor, Google Antigravity, Windsurf, Cline, and GitHub Copilot.",
    "category": "Development & Workflow",
    "capabilities": [
      "Read",
      "SecurityAnalysis",
      "TokenProfiling",
      "SkillManagement"
    ],
    "websiteURL": "https://github.com/gintingism/skillforge",
    "privacyPolicyURL": "https://github.com/gintingism/skillforge/blob/main/SECURITY.md",
    "termsOfServiceURL": "https://github.com/gintingism/skillforge/blob/main/LICENSE",
    "composerIcon": "skillforge_launch_cover.png",
    "logo": "skillforge_launch_cover.png",
    "screenshots": [
      "skillforge_launch_cover.png",
      "skillforge_shot2_token_budget.png",
      "skillforge_shot3_security_audit.png",
      "skillforge_shot4_universal_sync.png"
    ]
  },
  "skills": "./",
  "mcpServers": "./.registry/mcp.json",
  "holManifestOrigin": "repository",
  "registryIndexVersion": 9
}

Marketplace source

Repo URL
https://github.com/gintingism/skillforge
Marketplace path
.claude-plugin/marketplace.json
Source path
.
Install policy
Unspecified

Skills

26 SKILL.md files ship with this plugin. Preview, copy, or download each one, then install them with the Skills CLI.

Share
skills-cli
  • agent-observability

    src/skillforge/builtin_skills/agent-observability/SKILL.md

    Instrument agent tool calls, prompt latency, token expenditure, and error boundaries with structured OpenTelemetry or JSON-L logging. Use when debugging agent loops or optimizing multi-agent tracing.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • antislop-code

    src/skillforge/builtin_skills/antislop-code/SKILL.md

    Enforce rigorous code comment hygiene, anti-overengineering constraints, and eliminate AI-generated narrative filler while preserving valuable domain invariants. Use when reviewing code, refactoring modules, or auditing pull requests.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • blast-radius-containment

    src/skillforge/builtin_skills/blast-radius-containment/SKILL.md

    Analyze upstream callers, downstream dependencies, and enforce strict minimal-diff boundaries before modifying shared code. Use when modifying core utilities, database models, public API signatures, or widely imported types.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • caveman

    src/skillforge/builtin_skills/caveman/SKILL.md

    Ultra-terse, high-density technical communication mode that reduces output tokens while preserving technical accuracy, exact commands, and safety warnings. Use when concise responses or lower token consumption is desired.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • code-review

    src/skillforge/builtin_skills/code-review/SKILL.md

    Conduct disciplined multi-pass adversarial code reviews assessing correctness, security, performance, and test coverage. Use when reviewing diffs, pull requests, or staged changes before merging.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • cognitive-loop-breaker

    src/skillforge/builtin_skills/cognitive-loop-breaker/SKILL.md

    Detect and interrupt trial-and-error death spirals where repetitive edits fail tests across consecutive turns. Enforce a mandatory hypothesis reset and clean git rollback. Use when stuck in recurring test failures or repetitive debugging loops.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • context-compactor

    src/skillforge/builtin_skills/context-compactor/SKILL.md

    Distill extensive agent session transcripts into dense knowledge states, active hypothesis ledgers, and verified file citation indices. Use when context windows approach limits or during multi-agent handoffs.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • contract-test-generator

    src/skillforge/builtin_skills/contract-test-generator/SKILL.md

    Author property-based fuzz tests and contract invariants to verify edge cases, serialization symmetry, and boundary conditions. Use when testing schemas, parser logic, or public library APIs.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • dependency-upgrade

    src/skillforge/builtin_skills/dependency-upgrade/SKILL.md

    Manage methodical dependency updates with changelog and advisory review, incremental version bumps, automated regression test runs, and rollback plans. Use when updating packages, resolving security vulnerabilities, or modernizing outdated toolchains.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • flaky-test-isolation

    src/skillforge/builtin_skills/flaky-test-isolation/SKILL.md

    Diagnose and eliminate non-deterministic test failures caused by async race conditions, unseeded randoms, state leakage, or clock skew. Use when tests fail intermittently in CI or pass inconsistently.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • git-workflow

    src/skillforge/builtin_skills/git-workflow/SKILL.md

    Standardize Git hygiene with atomic conventional commits, pre-staging diff inspections, protected branch guardrails, and conflict pause protocols. Use when staging changes, writing commits, or resolving branch divergences.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • human-in-the-loop

    src/skillforge/builtin_skills/human-in-the-loop/SKILL.md

    Enforce explicit human approval boundaries before executing irreversible actions, deploying code, modifying schemas, or making external financial/data mutations. Use when building safe autonomous agent workflows.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • mcp-tool-designer

    src/skillforge/builtin_skills/mcp-tool-designer/SKILL.md

    Architect high-performance, type-safe Model Context Protocol (MCP) servers and tools with strict JSON schemas, token bounds, idempotent annotations, and decoupled error reporting. Use when designing MCP tools or building AI agent integrations.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • performance-profiler

    src/skillforge/builtin_skills/performance-profiler/SKILL.md

    Isolate latency bottlenecks, N+1 query patterns, memory allocations, and algorithmic complexity regressions using baseline-first measurement. Use when optimizing slow endpoints, high CPU/memory usage, or database queries.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • runtime-api-verification

    src/skillforge/builtin_skills/runtime-api-verification/SKILL.md

    Introspect installed packages, verify method signatures, and inspect type definitions before invoking unfamiliar third-party library APIs. Use when integrating third-party SDKs, upgrading dependencies, or resolving import errors.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • secret-sanitizer

    src/skillforge/builtin_skills/secret-sanitizer/SKILL.md

    Audit staged files, commit diffs, and terminal outputs for leaked API keys, tokens, and private credentials. Use when preparing git commits, staging code changes, or configuring environment variables.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • security-threat-modeler

    src/skillforge/builtin_skills/security-threat-modeler/SKILL.md

    Map trust boundaries, attack surfaces, object-level authorization (IDOR/BOLA), SSRF vectors, and injection sinks before shipping backend or agent endpoints. Use when reviewing security, designing APIs, or auditing auth flows.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • self-improving-agent

    src/skillforge/builtin_skills/self-improving-agent/SKILL.md

    Extract concrete lessons and operational heuristics from runtime failures, user corrections, and test cycles into durable project memory. Use when capturing recurring debugging patterns or user preferences.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • skill-architect

    src/skillforge/builtin_skills/skill-architect/SKILL.md

    Design, author, and refactor SKILL.md packages, AGENTS.md catalogs, and CLAUDE.md instructions using progressive disclosure and context-budget discipline. Use when creating or optimizing agent skills and instruction files.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • spec-driven-development

    src/skillforge/builtin_skills/spec-driven-development/SKILL.md

    Design systems contract-first using typed schemas, OpenAPI/JSON-Schema models, and failing test harnesses before writing application logic. Use when architecting new modules, APIs, or data models.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • summarize

    src/skillforge/builtin_skills/summarize/SKILL.md

    Distill complex engineering documents, logs, and pull request diffs into structured executive summaries with citations and key architectural decisions. Use when summarizing technical repositories or code reviews.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • supply-chain-sentinel

    src/skillforge/builtin_skills/supply-chain-sentinel/SKILL.md

    Verify third-party package existence, registry metadata, age, and CVE status before installing dependencies. Use when adding packages, upgrading libraries, or editing requirements and lockfiles.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • systematic-debugging

    src/skillforge/builtin_skills/systematic-debugging/SKILL.md

    Execute a disciplined four-phase root-cause investigation loop (Reproduce, Isolate, Hypothesize, Surgical Patch) before modifying code. Use when diagnosing failing tests, runtime crashes, race conditions, or performance regressions.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • tavily-search

    src/skillforge/builtin_skills/tavily-search/SKILL.md

    Execute targeted web research across high-trust primary sources, official documentation, and technical repositories. Use when researching cutting-edge library APIs, SDKs, or current industry standards.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • test-driven-development

    src/skillforge/builtin_skills/test-driven-development/SKILL.md

    Enforce rigorous Red-Green-Refactor development cycles with automated test runner discovery, failing reproduction assertions, and raw terminal exit criteria. Use when implementing new features, writing bug reproductions, or refactoring existing modules.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • zero-downtime-migration

    src/skillforge/builtin_skills/zero-downtime-migration/SKILL.md

    Plan and execute non-breaking database schema changes, table reorganizations, and API payload updates using the Expand-Contract pattern. Use when modifying SQL tables, ORM models, or public API endpoints in production systems.

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

File inventory

.agents/plugins/marketplace.json

file

2,276 bytes

ec2fbdae015f705c…

.claude-plugin/marketplace.json

file

2,276 bytes

ec2fbdae015f705c…

.claude-plugin/plugin.json

file

1,937 bytes

539c6826162b0cd5…

.codex-plugin/plugin.json

plugin-manifest

1,799 bytes

1750611c8bd46ef3…

.registry/mcp.json

mcp-config

124 bytes

d26b45cfbeeae30f…

LICENSE

file

1,468 bytes

acc212d24376c6d7…

mcp.json

file

257 bytes

df03b382290637eb…

plugin.json

file

1,937 bytes

539c6826162b0cd5…

pyproject.toml

file

1,960 bytes

3e1917eca71dc75d…

README.md

file

22,381 bytes

02287a1ee7083e2e…

requirements.txt

file

93 bytes

8ef99b26c48be90e…

SECURITY.md

file

1,056 bytes

715df9b78945f237…

skillforge_launch_cover.png

file

350,700 bytes

d443e0a82ce58286…

skillforge_shot2_token_budget.png

file

305,068 bytes

7ea7ad2127cc4b53…

skillforge_shot3_security_audit.png

file

263,844 bytes

769727d9c705fa73…

skillforge_shot4_universal_sync.png

file

286,748 bytes

dd4dc417a25b85c2…

src/skillforge/builtin_skills/agent-observability/SKILL.md

skill

1,260 bytes

2ce643dfbd6e1d8c…

src/skillforge/builtin_skills/antislop-code/SKILL.md

skill

1,891 bytes

b03cd3211edac43e…

src/skillforge/builtin_skills/blast-radius-containment/SKILL.md

skill

1,939 bytes

112d9d5094eec13e…

src/skillforge/builtin_skills/caveman/SKILL.md

skill

1,665 bytes

50e0f482d9c1772b…

src/skillforge/builtin_skills/code-review/SKILL.md

skill

2,360 bytes

f5caa8c549d7c89f…

src/skillforge/builtin_skills/cognitive-loop-breaker/SKILL.md

skill

2,206 bytes

2ce5388294c6aca1…

src/skillforge/builtin_skills/context-compactor/SKILL.md

skill

1,184 bytes

80ec172fd8225c8c…

src/skillforge/builtin_skills/contract-test-generator/SKILL.md

skill

2,043 bytes

31bd082f40a6447c…

src/skillforge/builtin_skills/dependency-upgrade/SKILL.md

skill

2,088 bytes

33245cd3542fa205…

src/skillforge/builtin_skills/flaky-test-isolation/SKILL.md

skill

2,395 bytes

527a3956bb295ca4…

src/skillforge/builtin_skills/git-workflow/SKILL.md

skill

2,028 bytes

90d20f05862e7b0d…

src/skillforge/builtin_skills/human-in-the-loop/SKILL.md

skill

1,233 bytes

743f7ae76d558f8d…

src/skillforge/builtin_skills/mcp-tool-designer/SKILL.md

skill

1,545 bytes

b3baf352bca11056…

src/skillforge/builtin_skills/performance-profiler/SKILL.md

skill

1,963 bytes

71c898fd575ff44a…

src/skillforge/builtin_skills/runtime-api-verification/SKILL.md

skill

1,948 bytes

9fb269004affdd33…

src/skillforge/builtin_skills/secret-sanitizer/SKILL.md

skill

2,014 bytes

dfcaa36ed24cfcfa…

src/skillforge/builtin_skills/security-threat-modeler/SKILL.md

skill

2,162 bytes

aa44388e180566b9…

src/skillforge/builtin_skills/self-improving-agent/SKILL.md

skill

1,081 bytes

45d0613131e1f7eb…

src/skillforge/builtin_skills/skill-architect/references/mechanics.md

file

1,398 bytes

ae298bc4750c7d4e…

src/skillforge/builtin_skills/skill-architect/SKILL.md

skill

2,439 bytes

ef62a47ebf46b6f5…

src/skillforge/builtin_skills/spec-driven-development/SKILL.md

skill

1,062 bytes

57a62f1756299a6b…

src/skillforge/builtin_skills/summarize/SKILL.md

skill

889 bytes

a3f186f55cff88b9…

src/skillforge/builtin_skills/supply-chain-sentinel/SKILL.md

skill

1,906 bytes

6710d4c108231a52…

src/skillforge/builtin_skills/systematic-debugging/SKILL.md

skill

2,027 bytes

4ba237d01ec5eee7…

src/skillforge/builtin_skills/tavily-search/SKILL.md

skill

935 bytes

524c8d9240a136d3…

src/skillforge/builtin_skills/test-driven-development/SKILL.md

skill

2,026 bytes

84159d90b114fabc…

src/skillforge/builtin_skills/zero-downtime-migration/SKILL.md

skill

2,213 bytes

2bc737dd58d43527…

SkillForge — Frequently asked questions

What is SkillForge?
SkillForge is an AI plugin in the HOL registry. Universal package manager, security auditor, and context token profiler for portable agent skills.
How do I install SkillForge?
Install SkillForge in your harness: Source — https://github.com/gintingism/skillforge/releases; Any agent — npx [email protected] add gintingism/skillforge. Full step-by-step guidance is on the HOL plugin page.
How do I install SkillForge in Source?
To install SkillForge in Source, start with https://github.com/gintingism/skillforge/releases. The complete step-by-step install guide for Source is on the HOL plugin page.
Is SkillForge free?
SkillForge is listed as free on HOL.
How is the Trust Score for SkillForge computed?
SkillForge has a HOL Trust Score of 83 out of 100. The score is a weighted sum of six components from a static scan of the source, capped for high-severity findings and adjusted by two disclosed policies. Memberships and payments are not inputs, and a scan is not a safety guarantee. Full breakdown: https://hol.org/registry/plugins/gintingism%2Fskillforge/trust
Who publishes SkillForge?
SkillForge is published by gintingism and listed on HOL.
Is SkillForge available now?
SkillForge is currently available according to its latest public launch.

Directory acceptance

Listed in 0 of 5 directory lists

Read from the list each directory publishes on GitHub. Being listed means the directory accepted the plugin; it is not a HOL security rating.

Lists last read . HOL re-reads them every day.

Submitting it? Check it against each directory's rules

Install signal

HOL cannot see every install. These are separate signals from different sources, so they are not added together. Counts under each floor show as <N.

Install commands issued here
<5
HOL Guard install commands issued from this listing, last 28 days.
Opt-in install reports
<10
Machines that reported installing it through HOL Guard in week 2026-W44. Reporting is opt-in, so most installs are not counted.
HOL Guard workspaces
<5
Workspaces that approved it or include it in an approved-plugin feed, as of today.
New GitHub stars
<5
From HOL's GitHub snapshots of the repository, 2026-11-03 to 2026-11-05.

History, reviews, and similar plugins

Latest launch