sangrokjung/claude-forge

{   "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",

"$schema": "https://anthropic.com/claude-code/marketplace.schema.json",

"owner": {     "name": "Sangrok Jung",     "url": "https://github.com/sangrokjung"

"name": "Sangrok Jung",     "url": "https://github.com/sangrokjung"   },

"url": "https://github.com/sangrokjung"

"author": {         "name": "Sangrok Jung",         "url": "https://github.com/sangrokjung"

"name": "Sangrok Jung",         "url": "https://github.com/sangrokjung"       },

"url": "https://github.com/sangrokjung"

"source": ".",       "category": "development",       "homepage": "https://github.com/sangrokjung/claude-forge",

"category": "development",       "homepage": "https://github.com/sangrokjung/claude-forge",       "tags": [

"homepage": "https://github.com/sangrokjung/claude-forge",

"name": "claude-forge",   "version": "4.3.0",   "description": "oh-my-zsh for Claude Code — 16 agents, 35 commands, 33 skills, 22 hooks + 9 examples (21 events), 14 rules, 4 MCP (minimal: playwright, context7, jina-reader, chrome-devtools@0

"version": "4.3.0",   "description": "oh-my-zsh for Claude Code — 16 agents, 35 commands, 33 skills, 22 hooks + 9 examples (21 events), 14 rules, 4 MCP (minimal: playwright, context7, jina-reader, chrome-devtools@0.23.0). Adversarial verifi

"description": "oh-my-zsh for Claude Code — 16 agents, 35 commands, 33 skills, 22 hooks + 9 examples (21 events), 14 rules, 4 MCP (minimal: playwright, context7, jina-reader, chrome-devtools@0.23.0). Adversarial verification loop (maker≠che

"description": "oh-my-zsh for Claude Code — 16 agents, 35 commands, 33 skills, 22 hooks + 9 examples (21 events), 14 rules, 4 MCP (minimal: playwright, context7, jina-reader, chrome-devtools@0.23.0). Adversarial verification loop (maker≠che

"author": {     "name": "Sangrok Jung",     "url": "https://github.com/sangrokjung"

"name": "Sangrok Jung",     "url": "https://github.com/sangrokjung"   },

"url": "https://github.com/sangrokjung"

},   "repository": "https://github.com/sangrokjung/claude-forge",   "homepage": "https://github.com/sangrokjung/claude-forge",

"repository": "https://github.com/sangrokjung/claude-forge",

"homepage": "https://github.com/sangrokjung/claude-forge",

The following 6 events are defined in the official Claude Code spec (see [code.claude.com/docs/en/hooks](https://code.claude.com/docs/en/hooks)) but claude-forge v3.0 does not ship example handlers. Consult the spec if you need to wire them

Each hook entry specifies a `type`. Claude Code supports four (Tier 0 source: [code.claude.com/docs/en/hooks](https://code.claude.com/docs/en/hooks), verified 2026-04-23):

[Credential-related source omitted]

#!/usr/bin/env bash

[Credential-related source omitted]

[Credential-related source omitted]

#!/bin/bash

rm -f "$LOG.tmp.$$" 2>/dev/null

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

find "$BASE/counts" "$BASE/runs" -type f -mtime +7 -delete >/dev/null 2>&1 &

#!/bin/bash

[Credential-related source omitted]

[Credential-related source omitted]

#!/bin/bash

#!/bin/bash

#!/bin/bash

[Credential-related source omitted]

#!/bin/bash

[Credential-related source omitted]

#!/usr/bin/env bash

#!/usr/bin/env bash

#!/usr/bin/env bash

#!/usr/bin/env bash

#!/usr/bin/env bash

#!/usr/bin/env bash

rm -f "$START_FILE"

#!/usr/bin/env bash

#!/usr/bin/env bash

#!/usr/bin/env bash

#!/bin/bash

#!/bin/bash

# git fetch (4초 타임아웃, settings.json의 훅 timeout 5초와 맞춤)

#!/bin/bash

[Credential-related source omitted]

#!/bin/bash

#!/bin/bash

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/bin/bash

rm -f "$POINTER" 2>/dev/null || true

find "$(relay_dir)" -maxdepth 1 -name '.pointer-*' ! -name '*.consumed' -mmin +720 -delete 2>/dev/null || true

#!/bin/bash

find "$SNAPSHOT_DIR" -name "*.md" -mtime +7 -delete 2>/dev/null

#!/bin/bash

#!/bin/bash

#   1. 파괴적 삭제 (rm -rf /, rm -rf ~, rm -rf *)

#   2. 환경변수/시크릿 유출 (env, printenv, echo $SECRET 등) #   3. 경로 순회 (/etc/passwd, /etc/shadow 등) #   4. 외부 통신 (curl, wget, nc, ncat 등)

#   3. 경로 순회 (/etc/passwd, /etc/shadow 등) #   4. 외부 통신 (curl, wget, nc, ncat 등) #   5. 권한 변경 (chmod 777, chown, mount 등)

#   4. 외부 통신 (curl, wget, nc, ncat 등)

#   5. 권한 변경 (chmod 777, chown, mount 등)

[Credential-related source omitted]

# rm -rf / , rm -rf ~ , rm -rf * 등 광범위 삭제만 차단

# rm /tmp/specific-file.txt 같은 특정 파일 삭제는 허용

r'\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s',  # rm -rf, rm -rfi 등

r'\brm\s+-[a-zA-Z]*f[a-zA-Z]*r[a-zA-Z]*\s',  # rm -fr, rm -fri 등

r'\brm\b.*\s+/$',                              # rm / (루트)

r'\brm\b.*\s+/\s',                             # rm / something

r'\brm\b.*\s+~/?(\s|$)',                        # rm ~ 또는 rm ~/

r'\brm\b.*\s+\*(\s|$)',                         # rm * (현재 디렉토리 전체)

[Credential-related source omitted]

#!/bin/bash

#!/bin/bash

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/bin/bash

#!/bin/bash

#!/bin/bash

#!/bin/bash

#!/bin/bash

async function getData(options: { limit: number }) {   'use cache'   return fetch(`/api?limit=${options.limit}`)

'use cache'   return fetch(`/api?limit=${options.limit}`) }

return fetch(`/api?limit=${options.limit}`)

async function getData(limit: number) {   'use cache'   return fetch(`/api?limit=${limit}`)

'use cache'   return fetch(`/api?limit=${limit}`) }

return fetch(`/api?limit=${limit}`)

When [Draft Mode](https://nextjs.org/docs/app/building-your-application/configuring/draft-mode) is enabled, cache entries are **not saved**:

async function fetchWithCache(url: string) {   'use cache'   return fetch(url).then((r) => r.json())

'use cache'   return fetch(url).then((r) => r.json()) }

return fetch(url).then((r) => r.json())

curl -I http://localhost:3000/your-page

claude --dangerously-skip-permissions

sudo apt install gh  # Ubuntu

git rm -r --cached .claude/context/

git rm -r --cached .claude/context/

claude --dangerously-skip-permissions

[Credential-related source omitted]

When you use the [Skill Creator GitHub App](https://skill-creator.app), it now generates **both**:

- [Skill Creator](https://skill-creator.app) - Generate instincts from repo history

- [Homunculus](https://github.com/humanplane/homunculus) - Inspiration for v2 architecture

- [The Longform Guide](https://x.com/affaanmustafa/status/2014040193557471352) - Continuous learning section

When instincts are imported from Skill Creator (repo analysis), they have: - `source: "repo-analysis"` - `source_repo: "https://github.com/..."`

- `source_repo: "https://github.com/..."`

#!/bin/bash

rm -f "$PID_FILE"

rm -f "$LOCK_FILE"

rm -f "$PID_FILE"

trap 'rm -f "$LOCK_FILE"' EXIT

rm -f "$PID_FILE"

trap 'rm -f "$PID_FILE"; exit 0' TERM INT

/instinct-import team-instincts.yaml /instinct-import https://github.com/org/repo/instincts.yaml

/instinct-import https://github.com/org/repo/instincts.yaml

},   "integration": {     "skill_creator_api": "https://skill-creator.app/api",

"integration": {     "skill_creator_api": "https://skill-creator.app/api",     "backward_compatible_v1": true

"skill_creator_api": "https://skill-creator.app/api",

#!/bin/bash

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

print(f"Fetching from URL: {source}")         try:             with urllib.request.urlopen(source) as response:

try:             with urllib.request.urlopen(source) as response:                 content = response.read().decode('utf-8')

with urllib.request.urlopen(source) as response:

import_parser.add_argument('source', help='File path or URL')     import_parser.add_argument('--dry-run', action='store_true', help='Preview without importing')     import_parser.add_argument('--force', action='store_true', help='Skip confi

import_parser.add_argument('--dry-run', action='store_true', help='Preview without importing')     import_parser.add_argument('--force', action='store_true', help='Skip confirmation')     import_parser.add_argument('--min-confidence', type=

import_parser.add_argument('--force', action='store_true', help='Skip confirmation')

// Memory profiling import _ "net/http/pprof" // Visit http://localhost:6060/debug/pprof/

// Visit http://localhost:6060/debug/pprof/

# Or manually check curl https://raw.githubusercontent.com/facebook/react/main/CHANGELOG.md

curl https://raw.githubusercontent.com/facebook/react/main/CHANGELOG.md

Read, Write, Edit, Bash, Grep, Glob

git clone https://github.com/bigcode-project/bigcode-evaluation-harness.git

[Credential-related source omitted]

[Credential-related source omitted]

- **GitHub**: https://github.com/bigcode-project/bigcode-evaluation-harness

- **Documentation**: https://github.com/bigcode-project/bigcode-evaluation-harness/tree/main/docs

- **BigCode Leaderboard**: https://huggingface.co/spaces/bigcode/bigcode-models-leaderboard

- **HumanEval Dataset**: https://huggingface.co/datasets/openai/openai_humaneval

- **MultiPL-E**: https://github.com/nuprl/MultiPL-E

# Install matching PyTorch (example for CUDA 11.8) pip install torch --index-url https://download.pytorch.org/whl/cu118

pip install torch --index-url https://download.pytorch.org/whl/cu118

# Install specific dependencies pip install -e ".[ds1000]" pip install torch==1.12.1+cu116 --extra-index-url https://download.pytorch.org/whl/cu116

pip install torch==1.12.1+cu116 --extra-index-url https://download.pytorch.org/whl/cu116

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# Clone repo git clone https://github.com/bigcode-project/bigcode-evaluation-harness.git

git clone https://github.com/bigcode-project/bigcode-evaluation-harness.git

sudo make DOCKERFILE=Dockerfile all

sudo make DOCKERFILE=Dockerfile-multiple all

1. **Check existing issues**: https://github.com/bigcode-project/bigcode-evaluation-harness/issues

Avoid for frequent eval (too slow):

- GitHub: https://github.com/EleutherAI/lm-evaluation-harness

- Docs: https://github.com/EleutherAI/lm-evaluation-harness/tree/main/docs

- Leaderboard: https://huggingface.co/spaces/HuggingFaceH4/open_llm_leaderboard (uses this harness)

[Credential-related source omitted]

lm_eval --model openai-chat-completions    --model_args      model=gpt-4-turbo,     base_url=https://api.openai.com/v1,

base_url=https://api.openai.com/v1,\

[Credential-related source omitted]

lm_eval --model anthropic-chat    --model_args      model=claude-3-5-sonnet-20241022,     base_url=https://api.anthropic.com,

base_url=https://api.anthropic.com,\

lm_eval --model local-completions    --model_args      model=meta-llama/Llama-2-7b-hf,     base_url=http://localhost:8000/v1,

base_url=http://localhost:8000/v1,\

lm_eval --model local-completions    --model_args      model=meta-llama/Llama-2-7b-hf,     base_url=http://localhost:8080/v1

base_url=http://localhost:8080/v1 \

lm_eval --model local-completions    --model_args      model=llama2:7b,     base_url=http://localhost:11434/v1

base_url=http://localhost:11434/v1 \

lm_eval --model local-completions    --model_args      model=llama2,     base_url=http://localhost:8080/v1

base_url=http://localhost:8080/v1 \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

model = MyCustomAPI(     base_url="https://api.example.com/v1",

base_url="https://api.example.com/v1",

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

curl http://localhost:8000/v1/models

lm_eval --model local-completions    --model_args      base_url=http://api.example.com/v1,

base_url=http://api.example.com/v1,\

lm_eval --model local-completions    --model_args      base_url=https://localhost:8000/v1,

base_url=https://localhost:8000/v1,\

- OpenAI API: https://platform.openai.com/docs/api-reference

- Anthropic API: https://docs.anthropic.com/claude/reference

- HuggingFace Accelerate: https://huggingface.co/docs/accelerate/

- vLLM docs: https://docs.vllm.ai/

- NeMo docs: https://docs.nvidia.com/nemo-framework/

Node components are also used when creating a RAG Pipe from a template, but in that context there is no workflowStore Provider, which results in a blank screen. [This Issue](https://github.com/langgenius/dify/issues/29168) was caused by exa

> *"target under 200 lines per CLAUDE.md file. Longer files consume more context and reduce > adherence"*, and rules without `paths` frontmatter load *"with the same priority as CLAUDE.md"* > — every session, every token ([memory docs](http

> — every session, every token ([memory docs](https://docs.claude.com/en/docs/claude-code/memory)).

#!/bin/bash

#!/usr/bin/env python3

#!/usr/bin/env python3

If `npx` is unavailable, install Node.js 18+ or follow https://github.com/NomaDamas/k-skill#readme, or read the vendored offline copy at `.claude/skills/korean-character-count/instruction.md` (audited 2026-08-11, commit 86096da).

- Unicode grapheme clusters: https://www.unicode.org/reports/tr29/

- WHATWG Encoding Standard: https://encoding.spec.whatwg.org/

- Node `Buffer.byteLength`: https://nodejs.org/api/buffer.html

#!/usr/bin/env node

If `npx` is unavailable, install Node.js 18+ or follow https://github.com/NomaDamas/k-skill#readme, or read the vendored offline copy at `.claude/skills/korean-spell-check/instruction.md` (audited 2026-08-11, commit 86096da).

- 기본 진입점은 공개 웹 표면 `https://nara-speller.co.kr/speller/` 이다.

- 자동화가 필요하면 이전 버전 폼 POST 표면 `https://nara-speller.co.kr/old_speller/results` 를 **낮은 요청량으로만** 사용한다.

- `https://nara-speller.co.kr/old_speller/` 는 **비상업적 용도** 안내와 **개인이나 학생만 무료**라는 문구를 명시한다.

- `https://nara-speller.co.kr/robots.txt` 는 `/` 를 허용하지만 `/test_speller/` 는 금지한다.

- 현재 공개 사이트는 `https://nara-speller.co.kr/speller/` 로 제공된다. - 이 환경에서 일반 shell/Node fetch는 Cloudflare 때문에 `403` 이 나올 수 있었다. - 같은 환경에서도 **브라우저형 User-Agent + Python stdlib `urllib` POST** 는 `old_speller/results` 에서 실제 검사 결과 HTML을 반환했다.

- guide: `https://nara-speller.co.kr/guide/`

- main UI: `https://nara-speller.co.kr/speller/`

- old UI / form post: `https://nara-speller.co.kr/old_speller/`, `https://nara-speller.co.kr/old_speller/results`

- robots: `https://nara-speller.co.kr/robots.txt`

Executable file

DEFAULT_RESULTS_URL = "https://nara-speller.co.kr/old_speller/results"

"Accept-Language": "ko,en-US;q=0.9,en;q=0.8",     "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",     "Origin": "https://nara-speller.co.kr",

"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",     "Origin": "https://nara-speller.co.kr",     "Referer": "https://nara-speller.co.kr/old_speller/",

"Origin": "https://nara-speller.co.kr",

"Referer": "https://nara-speller.co.kr/old_speller/",

request = urllib.request.Request(

try:         with urllib.request.urlopen(request, timeout=timeout) as response:

with urllib.request.urlopen(request, timeout=timeout) as response:

- [Custom Prompts — Codex | OpenAI Developers](https://developers.openai.com/codex/custom-prompts) (marks the feature DEPRECATED + the variable convention)

- [Slash commands — Codex CLI | OpenAI Developers](https://developers.openai.com/codex/cli/slash-commands)

- [Custom prompts in ~/.codex/prompts no longer appear after a CLI update · Issue #15941 · openai/codex](https://github.com/openai/codex/issues/15941)

- [Custom prompts — passing arguments · Issue #2890 · openai/codex](https://github.com/openai/codex/issues/2890)

#!/usr/bin/env python3

#!/usr/bin/env python3

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

#!/usr/bin/env bash

rm -f "$TMP"

rm -f "$PYLOG"

Executable file

Executable file

웹 브라우징: https://skills.sh/

Bash(bash:*), Bash(git:*), Bash(date:*), Bash(hostname:*), Bash(uname:*), Read, Write, Glob, Grep, AskUserQuestion

`tests/relay.bats` uses [bats-core](https://github.com/bats-core/bats-core). It is **not required** to use the

#!/bin/bash

#!/bin/bash

#!/bin/bash

cat "$file" | eval "$RELAY_CLIPBOARD_CMD"

#!/bin/bash

rm -f "$TMP" 2>/dev/null || true

rm -f "$(relay_consumed_path "$HASH")" 2>/dev/null || true

rm -f "$CLIP_TMP" 2>/dev/null || true

#!/usr/bin/env bats

[Credential-related source omitted]

[Credential-related source omitted]

# Get all active users     users_url = f"https://{OKTA_DOMAIN}/api/v1/users?filter=status eq \"ACTIVE\""     users = requests.get(users_url, headers=headers).json()

users_url = f"https://{OKTA_DOMAIN}/api/v1/users?filter=status eq \"ACTIVE\""

users = requests.get(users_url, headers=headers).json()

for user in users:         # Get MFA factors for each user         factors_url = f"https://{OKTA_DOMAIN}/api/v1/users/{user['id']}/factors"

# Get MFA factors for each user         factors_url = f"https://{OKTA_DOMAIN}/api/v1/users/{user['id']}/factors"         factors = requests.get(factors_url, headers=headers).json()

factors_url = f"https://{OKTA_DOMAIN}/api/v1/users/{user['id']}/factors"

factors = requests.get(factors_url, headers=headers).json()

<!-- With Subresource Integrity --> <script src="https://cdn.example.com/library.js"

<script src="https://cdn.example.com/library.js"

def fetch_url():     url = request.args.get('url')     response = requests.get(url)

url = request.args.get('url')     response = requests.get(url)     return response.text

response = requests.get(url)

try:         response = requests.get(url, timeout=5)

response = requests.get(url, timeout=5)

# .pre-commit-config.yaml repos:   - repo: https://github.com/gitleaks/gitleaks

repos:   - repo: https://github.com/gitleaks/gitleaks     rev: v8.18.0

- repo: https://github.com/gitleaks/gitleaks

- repo: https://github.com/PyCQA/bandit

- repo: https://github.com/pre-commit/pre-commit-hooks

CORS(app, resources={     r"/api/*": {         "origins": ["https://trusted-frontend.com"],

r"/api/*": {         "origins": ["https://trusted-frontend.com"],         "methods": ["GET", "POST"],

"origins": ["https://trusted-frontend.com"],

- Unix/Linux sudo logs

- SIEM: Splunk (https://siem.company.com)

- EDR: CrowdStrike (https://falcon.crowdstrike.com)

# Using EDR (CrowdStrike example via API) curl -X POST "https://api.crowdstrike.com/devices/v2/actions/contain" \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

Free Sources: ├─ MITRE ATT&CK Framework (https://attack.mitre.org)

├─ MITRE ATT&CK Framework (https://attack.mitre.org)

│  • Platform-specific matrices (Enterprise, Mobile, ICS) │ ├─ CVE/NVD (https://nvd.nist.gov)

│ ├─ CVE/NVD (https://nvd.nist.gov) │  • Common Vulnerabilities and Exposures

├─ CVE/NVD (https://nvd.nist.gov)

│  • Exploit availability │ ├─ AlienVault OTX (https://otx.alienvault.com)

│ ├─ AlienVault OTX (https://otx.alienvault.com) │  • Community-driven threat intelligence

├─ AlienVault OTX (https://otx.alienvault.com)

│  • Threat pulses and reports │ ├─ Abuse.ch (https://abuse.ch)

│ ├─ Abuse.ch (https://abuse.ch) │  • Malware samples and IOCs

├─ Abuse.ch (https://abuse.ch)

│  • ThreatFox (IOC database) │ ├─ CISA Alerts (https://www.cisa.gov/news-events/cybersecurity-advisories)

│ ├─ CISA Alerts (https://www.cisa.gov/news-events/cybersecurity-advisories) │  • US government cybersecurity advisories

├─ CISA Alerts (https://www.cisa.gov/news-events/cybersecurity-advisories)

│  • Recommended mitigations │ └─ VirusTotal (https://www.virustotal.com)

│ └─ VirusTotal (https://www.virustotal.com)    • File and URL scanning

└─ VirusTotal (https://www.virustotal.com)

**Severity**: Critical (CVSS 9.8) **Category**: Web Application Security **Affected System**: https://portal.acme.com/search

**Category**: Web Application Security **Affected System**: https://portal.acme.com/search **CVE**: N/A (Custom application)

**Affected System**: https://portal.acme.com/search

#### References - OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection

- OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env bash

#!/usr/bin/env python3

#!/usr/bin/env bash

- [The Longform Guide](https://x.com/affaanmustafa/status/2014040193557471352) - Token optimization section

#!/bin/bash

- [Microsoft STRIDE Documentation](https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats)

- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)

- [Threat Modeling: Designing for Security](https://www.wiley.com/en-us/Threat+Modeling%3A+Designing+for+Security-p-9781118809990)

name: summarize description: Summarize or extract text/transcripts from URLs, podcasts, and local files (great fallback for “transcribe this YouTube/video”). homepage: https://summarize.sh

description: Summarize or extract text/transcripts from URLs, podcasts, and local files (great fallback for “transcribe this YouTube/video”). homepage: https://summarize.sh metadata: {"openclaw":{"emoji":"🧾","requires":{"bins":["summarize"]

homepage: https://summarize.sh

summarize "https://example.com" --model google/gemini-3-flash-preview

summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto

summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto --extract-only

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]