a-mart/forge-project-resources
apps/backend/src/swarm/skills/builtins/forge-project-resources/SKILL.md
Author repo-root .forge project resources, including skills, specialists, reference docs, Project Agent definitions, Forge extensions, and Pi extensions/settings.
$ install --global
skillsauthnpx skillsauth add a-mart/forge forge-project-resourcesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 27, 2026, 5:11 AM117.1s2 files scanned
SKILL.md
- name:
- forge-project-resources
- description:
- Author repo-root .forge project resources, including skills, specialists, reference docs, Project Agent definitions, Forge extensions, and Pi extensions/settings.
Forge Project Resources
Use this skill when you need to add or update repo-root .forge/ resources that should travel with one repository.
Use this skill when
- you are editing
<repo>/.forge/skills/,.forge/specialists/,.forge/reference/,.forge/project-agents/,.forge/extensions/, or.forge/pi/ - you need a quick reminder of repo vs global/profile placement
- you want the smallest safe layout for a new project resource
Do not use this skill when
- the resource belongs in a global path like
~/.forge/skills/or~/.forge/agent/extensions/ - the resource belongs to one profile under
~/.forge/profiles/<profileId>/... - you are creating a profile-local Project Agent from an existing session; this skill is for repository-backed Project Agent definitions under
.forge/project-agents/ - you just need a new reusable skill; use
create-skillinstead
Workflow
- Confirm the repository root and the target resource type.
- Choose repo
.forgefor repository-shared content; use global/profile paths for user- or profile-specific content. - Keep passive resources as plain markdown or skill files.
- Treat executable resources as trust-gated:
- no secrets, credentials, or runtime state
- smoke tools should be deterministic and harmless
- if a Forge extension rewrites shell commands, quote or escape injected text before it reaches
bash - list repo Pi extensions explicitly in
.forge/pi/settings.jsonso loading stays deterministic
- If the work is mostly skill scaffolding or validation, hand that part to the existing
create-skillskill and its scripts. - Make the change as small as possible, then validate the file set in a fresh-session mindset.
Layout
See references/layouts.md for the quick path cheat sheet. In short:
.forge/skills/for repository skills.forge/specialists/for repository specialist markdown.forge/reference/for passive repository context.forge/project-agents/<definitionId>/config.json,prompt.mdrole instructions, and optionalreference/*.mdfor repository Project Agent definitions.forge/extensions/for trust-gated Forge extensions.forge/pi/extensions/and.forge/pi/settings.jsonfor trust-gated Pi extensions and package config
Safety notes
- Repository skills, specialists, reference docs, and Project Agent definition files are passive text.
- Repository Project Agent
prompt.mdcontains role instructions layered with Forge's Project Agent base prompt, andprompt.md/reference/*.mdare read live while the source is valid; missing/invalid sources leave the backing session/history intact but make live fields unavailable. - Project Agent capabilities are approved at activation from
config.json; later repo edits do not silently grant capabilities. Re-activate or link again to change approvals. - Deactivating/unlinking a repository Project Agent clears the session's source link only. It does not edit repo files or delete session history.
- Forge/Pi extensions and Pi settings can execute code, so review them before trusting.
- Keep
.forgeresources free of secrets.
Guardrails
- Keep executable smoke tools deterministic and harmless.
- Quote or escape rewritten shell text before it reaches
bash. - List repo Pi extensions explicitly in
.forge/pi/settings.json.
Output
- Note the target paths changed.
- Call out whether the resource is passive or trust-gated.
- Mention any remaining trust or scope questions.
Related Skills
a-mart/active-work-plans
data-ai
VerifiedTrustedCommunity
Use when substantial manager-led work needs durable visible progress, worker evidence links, review gates, blocker tracking, or handoff across pauses, stops, compaction, restart, or model changes. Do not use for quick answers or routine one-step work.
4SKILL.mdUpdated Jun 4, 2026
a-mart/create-skill
tools
VerifiedTrustedCommunity
Use when creating, refining, or validating reusable global, project, or repository skills, including trigger wording, templates, helper scripts, and validation checks.
4SKILL.mdUpdated Apr 28, 2026
a-mart/slash-commands
tools
VerifiedTrustedCommunity
Create, update, list, and delete global slash commands.
3SKILL.mdUpdated Mar 25, 2026
a-mart/memory
development
VerifiedTrustedCommunity
Update persistent swarm memory in ${SWARM_MEMORY_FILE} when the user explicitly asks to remember, update, or forget durable information.
3SKILL.mdUpdated Mar 25, 2026