
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
polyforgeai
Advanced tools
Self-adaptive Claude Code plugin for automated software development workflows
Self-adaptive Claude Code plugin for automated software development workflows.
PolyForge scans your project, detects your stack, architecture, and conventions, then provides intelligent slash commands to automate common development tasks.
npx polyforgeai install
This symlinks PolyForge skills and rules into ~/.claude/, making them available in any Claude Code session.
Restart Claude Code after installing or updating PolyForge — skills are loaded at session start.
.claude/ directory with custom commands or skills, back it up first (mv .claude .claude-backup) — /forge will recreate it cleanly/forge — PolyForge scans your project and generates an optimized configuration/hallmark, /smith #123, /sketch, etc.PolyForge speaks one voice — a blacksmith / forge theme. One craft verb per command.
| Command | Replaces | Description |
|---|---|---|
/forge | — | Scan project, detect stack/architecture/CI workflows/parallelism, generate config interactively |
/smith #N [#M ...] | /feature + /fix | Implement a ticket end-to-end — auto-classifies feature vs fix for the commit/PR prefix (override with --feat/--fix). Plan, implement, run CI mirror locally, transition tickets, one PR. Multi-ticket → parallel worktrees |
/quench | /fix-ci | Drive CI to green — diagnose and fix CI/CD failures, max 3 retries. Learns unmirrored CI commands via informed-consent flow |
/hallmark | /review | Review a PR, GitHub issue, or Jira ticket and stamp it — checks CI, quality, security |
/assay | /analyse-code | Whole-codebase quality audit — patterns, security, performance, config issues |
/blueprint | /analyse-db | Connect to DB, generate docs/DB.md schema documentation |
/sketch | /brainstorm | Plan / explore before building — produces an action plan with parallelizable tasks |
/probe | /diagnose | Root-cause one specific error or behavior |
/mark | /report-issue | Record a defect in the tracker — GitHub/Jira/GitLab |
/engrave | /generate-doc | Write / refresh Claude-optimized documentation |
/temper | /add-rule | Set a project rule or convention without re-running /forge |
/fold | /squash | Consolidate commit history before PR |
Note:
/feature+/fixare merged into a single/smith(one ticket = one PR; the prefix is auto-classified). This is a clean rename — the old command names no longer resolve, but natural-language invocation ("implement #42", "fix the CI") still works via each command's description.
/embersAutonomous overnight work = the banked embers that keep the forge working after hours. They run during your sleep window to exploit unused Claude subscription quota:
| Command | Replaces | Description |
|---|---|---|
/embers light | /routines-init | Install nocturnal routines: detects your Claude plan, proposes a profile (light/standard/full/unleashed), installs launchd plists |
/embers cast | /routines-create | Scaffold-guided creator for custom routines (scan / fix / review / report templates) |
/embers watch | /routines-logs | Read-only inspection of logs, telemetry, rate-limit state, worktrees |
/embers tend | /routines-manage | list / suspend / resume / delete / run-now / pause-all / promote-from-dry |
See docs/ROUTINES.md for the nocturnal routines quickstart and docs/DEV-WORKFLOW-SYNC.md for ticket transitions / CI mirror / parallel deep-dive.
/smith integrates with your project's real workflow:
In Progress → Code Review automatically. Terminal decisions (Blocked / Rejected) always require human confirmation via AskUserQuestion.github/workflows/*.yml) with a 3-retry auto-fix loop. Unmirrored CI commands are learned via /quench/smith #10 #11 #12 spawns isolated worktrees (one PR per ticket), orchestrator serializes user prompts, test execution can be gated by a global lock for projects with shared services (detected automatically)PolyForge uses Claude Code's native extension points:
.claude/skills/) — Each command is a SKILL.md that Claude Code loads on demand.claude/rules/) — Golden principles enforced across all interactionsAfter /forge, your project gets:
polyforge.json # Project config at repo root: stack, tracker, autonomy,
# CI mirror, parallelism, Jira transitions, git defaults
.claude/
rules/
polyforge-*.md # Stack-specific rules (scoped by file path)
CLAUDE.md # Short, high-signal project summary (<200 lines)
docs/
CONTEXT.md # Detailed architecture and project context
tmp/ # PolyForge working directory (gitignored)
Skills live at ~/.claude/skills/polyforge-* (installed globally by npx polyforgeai install) and are shared across all PolyForge-configured projects.
Configured per project during /forge:
By default, Claude Code asks for permission on every file edit and shell command. If you chose "full auto" during /forge, you'll be asked whether to grant full permissions for the project.
Via /forge (persistent, per-project):
Generates a .claude/settings.json that auto-approves all operations in the project directory. You can revert by deleting the file.
Via CLI flag (one-time, any project):
claude --dangerously-skip-permissions
Launches a single session with all permissions granted. Nothing is saved — next session returns to normal.
Install everything or pick what you need:
npx polyforgeai install # Install all skills & rules
npx polyforgeai install --force # Reinstall, overwriting existing
npx polyforgeai add-skill hallmark smith # Install specific skills only
npx polyforgeai remove-skill blueprint # Remove a skill
npx polyforgeai list # See available skills & install status
Auto-detected during /forge:
gh api.env, .jira confignpx polyforgeai update
npx polyforgeai uninstall
Issue tracker CLIs (install only what you use):
Note: PolyForge is built on Claude Code's native extension system (skills, rules, hooks). It requires Claude Code as its runtime and does not support other AI models or providers. The skills are plain markdown and could be adapted to other tools in the future, but the orchestration (subagents, worktrees, context management) relies on Claude Code.
Contributions are welcome! Please:
git checkout -b feature/my-feature)node --test tests/**/*.test.js)FAQs
Self-adaptive Claude Code plugin for automated software development workflows
We found that polyforgeai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.