
Threat Research
/Security News
Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
@firatcand/forge
Advanced tools
A lightweight framework for shipping software products from idea to production with AI coding agents (Claude Code, Codex CLI, Cursor, Gemini)

A lightweight Claude Code framework that takes you from idea to production with structure, not friction.
Forge is for solo founders and small teams who want to ship real products with Claude Code — not just experiment with it. It gives you a structured workflow for the parts that matter (ideation, decomposition, phase gates, learning capture) and stays out of your way for the parts where Claude Code already shines (planning, implementing, reviewing).
Forge ships:
IDEA → /forge → spec/BRIEF.md
→ /draft-prd → spec/PRD.md
→ /draft-spec → spec/SPEC.md
→ /draft-design → spec/DESIGN.md (optional, for UI products)
→ /ingest-spec → spec/CONTEXT.md (validation pass)
→ /decompose → plans/phases.yaml
→ /setup-repo → GitHub repo wired
→ /push-to-linear → Linear project + cycles + issues
TASK → /pickup-task → /plan-task → /implement
→ /review → /qa → /codex → /ship → /learn
PHASE → /phase-gate → /retro → next phase
PROD ← /phase-gate phase-3 ← (manual PR dev → main)
~90-120 minutes from raw idea to first task ready to implement.
The
/-prefixed names above are the Claude Code experience — typed slash commands. In other hosts (Codex CLI, Cursor, Gemini CLI), the same skills are available but invoked differently. See Cross-tool support below.
One command. No git clone, no setup script.
npx @firatcand/forge
This runs an interactive setup that:
Prefer the original bash flow?
git clone+./setup.shstill works as a fallback.
# Install forge globally (one time)
npx @firatcand/forge
# Initialize a new project
mkdir my-product && cd my-product
npx @firatcand/forge init
# Open your AI coding tool — see Cross-tool support below for per-host invocation
claude
> /forge # discovery interview → spec/BRIEF.md
> /draft-prd # → spec/PRD.md
> /draft-spec # → spec/SPEC.md
> /decompose # → plans/phases.yaml
> /setup-repo # GitHub repo wired
> /push-to-linear # Linear project + cycles
> /pickup-task # claim first task, worktree created
In Codex CLI, the same skills are installed but Codex doesn't expose user-defined slash commands — invoke them by description instead, e.g. Run forge's discovery interview for my project idea: .... Codex's model picks the skill up from ~/.codex/skills/forge/SKILL.md.
npx @firatcand/forge install # Install/reinstall forge skills + agents only
npx @firatcand/forge doctor # Audit installed skills + agents per detected tool
npx @firatcand/forge init [name] # Initialize a project in current directory
npx @firatcand/forge companions # Install founder-skills companions only
npx @firatcand/forge --help # Show all commands
npx @firatcand/forge --version # Show version
If a slash command stops triggering in one of your AI tools (e.g. you installed Codex CLI after running forge for the first time), run npx @firatcand/forge doctor to see exactly what's installed where, then npx @firatcand/forge install to sync.
The installer detects which tools you have and installs forge skills + subagents into each. The skills land in every host, but how you invoke them differs by host.
| Host | Install path | How to invoke a forge skill | Status |
|---|---|---|---|
| Claude Code | ~/.claude/skills/, ~/.claude/agents/ | Typed slash commands: /forge, /draft-prd, … | ✅ Verified |
| Codex CLI | ~/.codex/skills/, ~/.codex/subagents/ | Natural language — Codex doesn't expose user slash commands. Ask the model: "Run forge's discovery interview for …" | ✅ Skills load; no /forge syntax |
| Cursor | ~/.cursor/skills/, ~/.cursor/agents/ | Unverified — invocation mechanism not yet tested by maintainer | ⚠️ Unverified |
| Gemini CLI | ~/.gemini/extensions/ | Unverified — uses Gemini's extensions format, may need manual config | ⚠️ Unverified |
If you're on Codex/Cursor/Gemini and /forge doesn't trigger, that's expected — try the natural-language form. Run npx @firatcand/forge doctor to confirm the skills are physically present at the expected paths.
If you discover the right invocation pattern for Cursor or Gemini and it differs from natural language, please open an issue or PR — the maintainer is actively looking for confirmation on those two.
Forge is what you do when you have raw material (an idea) and want a finished tool (a product). The process is heat, pressure, shape, repeat. The framework's namesake skill /forge is a discovery interview that applies pressure to your raw idea until structure emerges.
Forge stands on the shoulders of:
What forge adds:
@inherit pattern lets your design system stay single-source-of-truth across projectsForge is v0.2.1 — used in production by the maintainer for solo founder workflows. Stable enough to depend on, raw enough that you'll find sharp edges. Issues and PRs welcome.
MIT. See LICENSE.
See CONTRIBUTING.md. The contribution model is gstack-shaped: skills as markdown files, principles in ETHOS.md, no exotic dependencies.
FAQs
A lightweight framework for shipping software products from idea to production with AI coding agents (Claude Code, Codex CLI, Cursor, Gemini)
The npm package @firatcand/forge receives a total of 36 weekly downloads. As such, @firatcand/forge popularity was classified as not popular.
We found that @firatcand/forge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.