How do I install the Forge Security skill?

Run npx skillmds@latest add is-bo/forge-security-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Forge Security skill do?

Perform a threat-informed audit of trust boundaries, injection, secrets, browser controls, dependencies, and abuse cases. It is listed under Security on SkillMD.

Is Forge Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Forge Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Forge Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Forge Security?

is-bo (@is-bo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Forge Security by is-bo — Agent Skill

Name: Forge Security
Author: is-bo

File contents

Fullstack Forge adapter: forge-security

This file is a pointer maintained by Fullstack Forge. It exists so this agent host can discover and trigger the skill. The full playbook is not duplicated here: one canonical copy is shared by every installed host.

Read the canonical playbook now and follow it exactly:

../../../.fullstack-forge/skills/forge-security/SKILL.md

That path is relative to this file. From the installation root it is .fullstack-forge/skills/forge-security/SKILL.md. Every resource the playbook references (fullstack-forge/references/..., fullstack-forge/schemas/..., fullstack-forge/templates/..., fullstack-forge/profiles/...) resolves relative to .fullstack-forge/skills/. The canonical playbook owns any deterministic composition step; perform that step exactly once. This adapter never adds a second workflow or composition command.

Do not edit this adapter; edit the canonical playbook instead. If the canonical file is missing or unreadable the installation is damaged. Report it and repair through the same project-package, archive, or plugin mechanism that installed this adapter. Never fall back to an unpinned npx forge, which may resolve an unrelated public package.

Frequently asked questions

Forge Security