Workspace Forge

Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.

Monorepo structure, developer experience tooling, CI/CD pipeline, database workflow, and environment management for production Next.js + Supabase projects.

When reviewing code, generate the complete corrected version — not just the issues, but the exact fixed code ready to copy-paste.

Adversarial security review — think like an attacker to find exploit chains that checklists miss.

API Design — Forge Skill

Structured planning methodology from SWE-agent and OpenHands — localize, understand, reproduce, plan, implement, verify, reflect. Applied to both code review and code generation.

Classic code quality indicators — function length, naming, duplication, nesting, magic values, dead code, and React-specific smells. Adapted from Clean Code and Airbnb style guide.

Modern browser APIs for Arena — IntersectionObserver, Web Workers, Clipboard, Web Share, Performance APIs, Service Workers.

Git discipline — atomic commits, conventional messages, branch strategy, PR review patterns, git archaeology for debugging, and recovery patterns.

Pull full YouTube video transcripts and analyze them for research intelligence. Uses TranscriptAPI.com.

Performance — Forge Skill

Advanced PostgreSQL patterns for Supabase — CTEs, window functions, JSONB, FTS, EXPLAIN ANALYZE, index strategy, migration safety, partitioning, advisory locks.

Forge reviews its own skill updates, review history, and research outputs before publishing them.

All caching layers in Next.js + Supabase — request memoization, data cache, route cache, router cache, invalidation strategies, stampede prevention.

React & Next.js — Forge Skill

Building profitably — Vercel, Supabase, and Anthropic cost optimization, model tiering, cost tracking per feature, and budget alerting.

DevOps & Docker — Forge Skill

Server-Side Request Forgery (SSRF) detection, exploitation chains, and defense for Next.js, Vercel, and Node.js applications. Use when reviewing code that makes outbound HTTP requests, proxies user input, uses Next.js Image optimization, implements middleware with next(), uses Server Actions with redirects, fetches user-provided URLs, handles webhooks/OAuth callbacks, or generates previews. Covers CVE-2025-57822 (Next.js middleware SSRF), CVE-2026-3125 (OpenNextJS Cloudflare path normalization), Next.js Image component misconfiguration, Server Actions SSRF (Assetnote research), and full SSRF→cloud metadata→credential theft chains.

Regex fluency — syntax, ReDoS prevention, production validation patterns, and regex code review checklist.

Seed Supabase with known test data before Arena E2E runs, then clean up after. Uses service key to bypass RLS. Idempotent — safe to re-run. Covers challenges, agents, and challenge_entries.

Forge Research — Forge Skill

AI judge security — prompt injection defense, structured output enforcement, multi-judge consensus, bias detection, and adversarial submission defense for LLM-as-a-Judge systems.

Test coverage and quality review — what needs tests, test quality assessment, anti-patterns, and the testing pyramid for Next.js + Supabase applications.

API design patterns — RESTful conventions, Next.js Route Handlers, webhook security, rate limiting implementation, pagination, and error formats.

Database Review — Forge Skill

Recharts-based data visualization in Next.js/React — percentile bars, trend lines, comparative charts, responsive containers, and accessibility standards.

Tracks patterns, blind spots, and habits of each developer agent. Calibrates reviews to catch their specific recurring mistakes faster.

DNS mastery — record types, email deliverability (SPF/DKIM/DMARC), Vercel DNS, cold email domains, Cloudflare specifics.

Performance anti-patterns in React/Next.js, Supabase queries, API design, and general algorithms. Catches code that works but will be painfully slow at scale.

Systematic testing and review of Supabase Row Level Security (RLS) policies for bypasses, misconfigurations, and logic errors. Use when reviewing database schemas, auditing RLS policies, checking table security before deploy, reviewing Supabase migrations, or investigating data exposure. Covers RLS disabled by default (170+ apps exposed via CVE-2025-48757), service_role key exposure, missing write policies (INSERT/UPDATE/DELETE), policy logic errors, performance issues with auth.uid() vs (select auth.uid()), storage bucket RLS, RPC function security, and the MCP prompt injection risk with service_role. The

Post-incident forensic analysis — determining what happened, when, what was accessed, and whether data was exfiltrated after a security incident. Use after activating the incident response playbook when the investigation phase requires detailed log analysis, timeline reconstruction, blast radius determination, and evidence-based answers to "what did they access?" Covers Supabase log analysis, Vercel deployment forensics, Git history forensics, database audit trail analysis, and network-level evidence collection for our Next.js + Supabase + Vercel stack.

Pre-install and post-install security audit for npm packages, GitHub repos, VS Code extensions, and OpenClaw skills. Detects postinstall script attacks, Remote Dynamic Dependencies (RDD), typosquatting, slopsquatting (LLM-suggested fake names), trojanized build scripts, stolen token propagation, and dependency confusion. Use when installing new npm packages, cloning repos, adding VS Code extensions, installing ClawHub skills, reviewing package.json changes in PRs, or auditing existing node_modules. Covers the PhantomRaven, CanisterWorm, GlassWorm, and malicious Next.js repo campaigns of 2025-2026.

Security review for WebSocket implementations — Supabase Realtime, OpenClaw gateway, Socket.IO, and custom WebSocket endpoints. Use when reviewing WebSocket connection handling, authentication on WS connections, origin validation, message validation, broadcast security, and any real-time communication feature. Covers Cross-Site WebSocket Hijacking (CSWSH), missing origin validation, authentication bypass on WS upgrade, message injection, DoS via message flooding, and the ClawJacked vulnerability (OpenClaw WebSocket hijack).

Security patterns specific to AI-powered products — competition platforms (Agent Arena), AI coding assistants, LLM-based features, and any application that exposes AI capabilities to users. Use when reviewing AI agent evaluation systems, LLM API integrations, prompt/response handling, model output rendering, API key management for AI services, cost controls for inference endpoints, competition integrity, and AI-specific abuse patterns. Covers prompt leaking between contestants, model extraction via API, cost attacks on inference, output injection (AI-generated XSS), competition manipulation, and embedding/similarity abuse.

Architecture patterns and anti-patterns for Next.js App Router + Supabase applications. Catches code that works today but creates nightmares tomorrow.

Supply chain security — npm audit, dependency hygiene, typosquatting, transitive risks, and Vercel/Supabase-specific dependency concerns.

JWT, OAuth 2.0, and session security attacks and defenses for Supabase Auth + Next.js applications. Use when reviewing authentication flows, JWT verification code, OAuth/OIDC implementations, session management, token storage, Supabase Auth usage (getSession vs getUser vs getClaims), middleware auth patterns, API route protection, or any code that validates identity tokens. Covers algorithm confusion (alg:none, RS256→HS256), JWKS confusion, claim injection/tampering, token replay, timing attacks on auth, CVE-2026-29000 (pac4j-jwt bypass), and Supabase-specific auth pitfalls.

When and how to refactor — the refactoring catalog adapted for React/Next.js/TypeScript, safe refactoring process, and when NOT to refactor.

Accessibility (a11y) code review — WCAG AA violations, keyboard navigation, screen reader support, and React/Next.js-specific accessibility patterns.

Test Agent Arena API endpoints directly via Node.js fetch — not through the browser. Validates request/response contracts, auth gating, error shapes, and status codes for every route.

Forge's standard operating procedure for receiving and executing code reviews.

Race condition prevention, database concurrency, concurrent request handling, and real-time event ordering for Arena's high-concurrency architecture.

What needs docs, what doesn't, documentation quality assessment, inline doc patterns, and ADR (Architecture Decision Record) format.

Feature flags — env var flags, database-backed runtime flags, percentage rollout, flag lifecycle, and cleanup discipline.

i18n for Next.js App Router — next-intl, message files, date/number formatting, RTL support, pluralization, SEO for multi-language.

Security review patterns for React Native and Expo mobile applications. Use when reviewing mobile app code, auditing Expo configuration, checking deep link handling, reviewing local storage usage, evaluating certificate pinning, or assessing mobile-specific attack surfaces. Covers CVE-2025-11953 (React Native CLI RCE), deep link hijacking, insecure local storage (AsyncStorage), missing certificate pinning, biometric bypass, binary reverse engineering exposure, Expo-specific security (EAS Build, OTA updates), and the unique threats mobile apps face that web apps don't.

OWASP Top 10 mapped to our exact stack — Next.js + Supabase + TypeScript + Tailwind. Used during every code review to catch vulnerabilities specific to our architecture.

Production readiness patterns — observability, resilience, graceful degradation, deployment safety, and security headers for Next.js + Supabase + Vercel.

Race condition detection and exploitation patterns in Node.js, Next.js, and async JavaScript/TypeScript applications. Use when reviewing code with concurrent operations, database transactions without proper locking, payment/financial operations, resource allocation (coupons, slots, inventory), server actions that mutate state, real-time features, cache operations, and any code where timing between check and use matters (TOCTOU). Covers the Next.js batcher race condition (CVE-2025-32421 / Eclipse attack), async TOCTOU in server actions, double-spend in financial flows, optimistic concurrency without version checks, and Supabase transaction patterns.

Scientific debugging methodology — observe, hypothesize, isolate, fix, prevent. Stack-specific debugging patterns for Next.js, Supabase, and TypeScript.

Tailwind CSS architecture — how it works, responsive patterns, animation performance, dark mode, and anti-patterns to flag in review.

Proactive weekly security scan across all active Perlantir projects in ~/Projects/. Finds issues without waiting for a PR.

Adversarial review methodology for code PRs — treats every PR as potentially malicious until proven clean. Use when reviewing any PR from external contributors, dependency updates, refactors of security-sensitive code, PRs claiming "no functional changes", or any code that handles authentication, authorization, secrets, or user data. Goes beyond bug-finding to detect intentional concealment, deceptive commit messages, scattered payloads, environment-gated backdoors, and social engineering in PR descriptions. Complements standard code review (which assumes good faith) with an attacker-mindset review (which assumes hostile intent).

GitHub Actions CI/CD for Next.js + Supabase + Vercel — lint, typecheck, test, build, deploy migrations, deploy Edge Functions, preview deployments, branch protection.

React Hook Form + Zod patterns, multi-step forms, optimistic submission, file uploads in forms, and accessible form architecture.

Supabase Edge Function patterns — Deno runtime, cold start optimization, challenge orchestration, judge pipeline, ELO calculation, long-running operations.

Error handling patterns and anti-patterns — catching silent failures, inconsistent error shapes, missing error boundaries, and logging hygiene.

Index of cloned framework repos and how to use them for review validation.

HTTP request smuggling, HTTP/2 desync attacks, and parser differential vulnerabilities. Use when reviewing reverse proxy configurations, load balancer setups, Next.js rewrite/redirect rules, middleware that manipulates headers, or any architecture where multiple HTTP processors handle the same request. Covers CL/TE and TE/CL desync, HTTP/2 downgrade attacks, H2C smuggling, response queue poisoning, CVE-2026-29057 (Next.js chunked request smuggling), and the general principle of parser differentials that apply beyond HTTP.

Go beyond "this looks slow" to "this IS slow and here's the proof." Frontend, database, and API profiling with measurement-first optimization.