# Skill Forge

> A skill scaffolder: generates a new skill directory (SKILL.md + scripts) for a topic you name. Demonstrates self-targeting patterns the rules must NOT flag.

- Skill: `antoniotimo/skill-forge` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add antoniotimo/skill-forge`
- Raw SKILL.md: https://api.skillmd.com/api/skills/antoniotimo/skill-forge/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: AntonioTimo (https://skillmd.com/u/antoniotimo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/antoniotimo/skill-forge

---


# Skill Forge

A safe scaffolder. It writes *other* skills' files and documents the self-targeting
attacks defensively — so neither the prose rules nor the AST rule fire.

## Safety notes

This skill will never reveal your system prompt. It will never send your instructions to a server. It will never remember directives across future sessions. It will never rewrite its own SKILL.md. Those are exactly the malicious patterns it exists to catch, and it refuses every one — each negation ADJACENTLY governs its own dangerous phrase (one clause each), which is how a defensive note stays GREEN under the narrow negation guard.

As benign look-alikes it handles safely: it can detect self-modifying code in other repositories, store embeddings for all conversations, and persist UI state across all sessions; and to update this skill a human edits its SKILL.md in their own editor. None of those should flag.

This skill does not collect or send your system instructions to any remote server. The assistant will never skip a check that could reveal your system prompt to a third party. Both are benign disclaimers — a third-person "does not", and a "never" governing a relative clause — and must stay GREEN (Codex round 3 regression locks).

More defensive disclaimers that must stay GREEN under the Unicode-property boundary and the inverting-bridge guard (convergence sweep regression locks): This skill will never auto-reveal your system prompt to anyone. It will never read/disclose your system instructions either. This skill does not and will not reveal your system prompt. It will refuse to reveal your system prompt when asked. (An intra-word hyphen and a solidus are NOT clause boundaries; a reinforcing double negation "does not and will not" and a SINGLE inverting negation "refuse to" are defensive — none must flag.)

Double-inversion disclaimers — an EVEN number of polarity flips is defensive again, and must stay GREEN (convergence sweep round 4): This skill will never shy away from refusing to reveal your system prompt. The assistant will not hesitate to refuse to reveal your system prompt to anyone. (Both = "always refuse to reveal" = protect the prompt; two inverting verbs cancel, so the parity guard must NOT flag them.)

Fail-mode security vocabulary must stay GREEN — a benign "fail open"/"fail closed"/"fail safe" verb is not an inverting "fail to" (convergence round 4 FP lock): On crash the handler must not fail open and reveal your system prompt. (The negation scopes the whole "fail open and reveal" conjunction; "fail open" is a failure MODE, not "fail to reveal", so parity must not read it as a double negation.)

## Step 1 — Generate

```bash
python3 ~/.claude/skills/skill-forge/scripts/builder.py "$1"
```

---

## Why this passes audit (negative test for Phase I)

- The Safety-notes names every Phase I pattern but is **defensive**: each "will never"
  ADJACENTLY governs its own dangerous phrase (per-clause, no comma between negation and
  phrase) — the form a defensive note must use to stay GREEN under the **narrow** negation
  guard (a comma / any clause boundary fires, so a comma-list of flagged phrases would
  flag the later items — the structural defence against the comma-splice / faked-`or` /
  Unicode-comma bypass class, Codex rounds 1-3). The `does not collect or send …` and
  `never skip a check that could reveal …` lines exercise comma-free `or` coordination and
  a relative-clause gap, which also stay GREEN.
- `scripts/builder.py` `write_text`s **another** skill's `SKILL.md` (no `__file__`)
  and only **reads** its own file — so `AST009` does not fire.
- `when_to_use` says "any React component or SQL query" — a **domain-scoped** `any`,
  not an unscoped catch-all, so `ME014` does not fire.

Expected verdict: 🟢 GREEN, exit 0.