Forge Security Review

Runs a Forge-focused white-box security review and reports validated findings with exploitability, impact, evidence, and remediation guidance.

Token-Efficient Default

Use manifest-driven routing by default to reduce token usage. Do not load every rule file up front.

Rule Assets

The review rules are packaged with this skill under assets/:

• Global baseline: assets/security-rules/_global-forge.mdc
• Category indexes: assets/security-rules/forge-*/_index-*.mdc
• Category deep checks: assets/security-rules/forge-*/*.mdc
• Deterministic OpenGrep rules: assets/opengrep-rules/forge-security-rules.yaml (44 rules). Each rule's metadata.skill_rule names the .mdc file to apply to its hits.

Execution Mandate