
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
polyforgeai
Advanced tools
Self-adaptive Claude Code plugin for automated software development workflows.
PolyForge scans your project, detects your stack, architecture, and conventions, then provides intelligent slash commands to automate common development tasks.
npx polyforgeai install
This symlinks PolyForge skills and rules into ~/.claude/, making them available in any Claude Code session.
Restart Claude Code after installing or updating PolyForge — skills are loaded at session start.
.claude/ directory with custom commands or skills, back it up first (mv .claude .claude-backup) — /forge will recreate it cleanly/forge — PolyForge scans your project and generates an optimized configuration/pr-review, /fix #123, /brainstorm, etc.| Command | Description |
|---|---|
/forge | Scan project, detect stack/architecture, generate config interactively |
/pr-review | Review a PR with fresh context — checks CI, code quality, security |
/analyse-db | Connect to DB (Docker or direct), generate docs/DB.md schema documentation |
/analyse-code | Full codebase analysis — patterns, security, performance, config issues |
/diagnose | Investigate a specific error or behavior — determine root cause and if it's a real bug |
/report-issue | Detect and create issues on GitHub/Jira/GitLab |
/feature #N | Build a feature from an issue — plan, implement, test, PR |
/fix #N | Fix an issue — branch, implement, test, PR (autonomy level configurable) |
/fix-ci | Diagnose and fix CI/CD failures — loops max 3 times then reports |
/brainstorm | Free-form brainstorming — produces action plan with parallelizable tasks |
/generate-doc | Generate/update Claude-optimized documentation (CLAUDE.md, docs, rules) |
/squash | Clean up commit history — regroup messy commits into logical units before PR |
/add-rule | Add project rules or conventions without re-running /forge |
PolyForge uses Claude Code's native extension points:
.claude/skills/) — Each command is a SKILL.md that Claude Code loads on demand.claude/rules/) — Golden principles enforced across all interactionsAfter /forge, your project gets:
.claude/
polyforge.json # Project config (stack, tracker, autonomy, pipeline)
rules/
polyforge-*.md # Stack-specific rules (scoped by file path)
skills/ # (symlinked from PolyForge install)
CLAUDE.md # Short, high-signal project summary (<200 lines)
docs/
CONTEXT.md # Detailed architecture and project context
tmp/ # PolyForge working directory (gitignored)
Configured per project during /forge:
By default, Claude Code asks for permission on every file edit and shell command. If you chose "full auto" during /forge, you'll be asked whether to grant full permissions for the project.
Via /forge (persistent, per-project):
Generates a .claude/settings.json that auto-approves all operations in the project directory. You can revert by deleting the file.
Via CLI flag (one-time, any project):
claude --dangerously-skip-permissions
Launches a single session with all permissions granted. Nothing is saved — next session returns to normal.
Install everything or pick what you need:
npx polyforgeai install # Install all skills & rules
npx polyforgeai install --force # Reinstall, overwriting existing
npx polyforgeai add-skill pr-review fix # Install specific skills only
npx polyforgeai remove-skill analyse-db # Remove a skill
npx polyforgeai list # See available skills & install status
Auto-detected during /forge:
gh api.env, .jira confignpx polyforgeai update
npx polyforgeai uninstall
Issue tracker CLIs (install only what you use):
Note: PolyForge is built on Claude Code's native extension system (skills, rules, hooks). It requires Claude Code as its runtime and does not support other AI models or providers. The skills are plain markdown and could be adapted to other tools in the future, but the orchestration (subagents, worktrees, context management) relies on Claude Code.
Contributions are welcome! Please:
git checkout -b feature/my-feature)node --test tests/**/*.test.js)FAQs
Self-adaptive Claude Code plugin for automated software development workflows
The npm package polyforgeai receives a total of 2 weekly downloads. As such, polyforgeai popularity was classified as not popular.
We found that polyforgeai demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.