Bmad Module Skill Forge — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Bmad Module Skill Forge (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
<img src="website/public/img/skf-logo-animated.svg" alt="Skill Forge Logo" width="120" />
Turn code and docs into instructions AI agents can actually follow.
_Skill Forge analyzes your code repositories, documentation, and developer discourse to build verified instruction files for AI agents. Every instruction links back to its upstream — a specific file:line at a pinned commit when source is available, or a documentation URL when it isn't._
If SKF fixes your agent's API guesses, give it a ⭐ — it helps others find this tool. If it saved you an afternoon, [grab me a coffee ☕](https://buymeacoffee.com/armelhbobdad) — it helps me keep forging.
</div>
You ask an AI agent to use a library. It invents function names that don't exist. It guesses parameter types. You paste documentation into the context — it still gets details wrong. You write instructions by hand — they go stale the moment the code changes.
This isn't an edge case. It's the default experience.
For the full story behind SKF, read _Hallucination has a line number_ on Medium.
Without SKF — your agent guesses:
import cognee
# Agent hallucinates: sync call, wrong parameter name, missing await
results = cognee.search("What does Cognee do?", mode="graph")With SKF — your agent reads the verified skill:
import cognee
# Agent follows the skill instruction:
# `search(query_text: str, query_type: SearchType = GRAPH_COMPLETION) -> List[SearchResult]`
# [AST:cognee/api/v1/search/search.py:L27]
results = await cognee.search(
query_text="What does Cognee do?",
query_type=cognee.SearchType.GRAPH_COMPLETION
)The skill told the agent the real function name, the real parameters, and that the call is async — all traced to the exact source line. This example is from the real oms-cognee skill in oh-my-skills — SKF's reference output. The Verifying a Skill section below shows how to walk the citation chain yourself.
Linux, Windows, and macOS supported (platform details). Requires Node.js >= 22, Python >= 3.10, and uv (Python package runner).
npx bmad-module-skill-forge installYou'll be prompted for project name, output folders, and IDE configuration. When the install completes, open your IDE and invoke @Ferris SF to confirm Ferris is reachable. Ferris reports your detected tools and capability tier. See the docs for other install methods.
@Ferris SF _(Setup Forge)_ — detects your tools and sets your capability tier@Ferris forge-auto <repo-or-doc-url> _(Forge-Auto)_ — one command turns a repo or doc URL into a verified skill (auto-scope, auto-brief, 90% quality gate, export)@Ferris QS <package-name> _(Quick Skill)_ — creates a verified skill in under a minute@Ferris forge <your-library> chains Brief → Create → Test → Export automatically — or run manually: @Ferris BS → clear session → @Ferris CS for maximum controlFor producing many coordinated skills across sessions, @Ferris campaign _(Campaign)_ orchestrates the whole set with dependency tracking and resume.
Tip: Start a fresh conversation before each workflow, or use pipeline mode to chain them automatically. SKF workflows load significant context; clearing between them prevents interference.
See the workflows docs for all available workflows, pipeline aliases, and headless mode.
A skeptical reader is probably already considering one of these alternatives:
| Skill Forge | MCP doc servers | Hand-edited .cursorrules | awesome-\* lists | |
|---|---|---|---|---|
| Reproducible from upstream | AST + pinned commit (or pinned doc URL) | varies; opaque | whatever you wrote | none |
| Version-pinned & immutable | yes — per-version directories | runtime-dependent | rots silently | no |
| Audit trail | provenance-map.json + test + evidence | depends on server | none | none |
| Runtime cost | zero (markdown + JSON) | a running process | zero | zero |
| Lifecycle tooling | rename, drop, update, export transactions | varies | file surgery | none |
| Falsifiable | yes — three steps, 60 seconds | rarely | no | no |
The others aren't bad. They solve different problems. SKF solves exactly one: the claim your agent is reading about a library was true at a specific commit on a specific day, and you can prove it in under a minute.
SKF extracts real function signatures, types, and patterns from code, docs, and developer discourse — every instruction links to the exact file and line it came from. On top of that foundation:
Every skill ships two files — `SKILL.md` (the full instruction set, loaded on trigger) and `context-snippet.md` (an 80–120 token always-on index that the export step injects into `CLAUDE.md` / `AGENTS.md` / `.cursorrules`). Why both? Per Vercel's agent evals, passive context achieves a 100% pass rate vs. 79% for active skills loaded alone (see Skill Model → Dual-Output Strategy).
You can falsify any citation in an SKF-compiled skill in under a minute:
source_file and source_line.source_commit and source_repo.SKILL.md should match the one you're reading.For docs-only skills, the audit shape is the same — provenance-map.json still lists every symbol — but entries cite [EXT:{url}] instead of file:line@SHA, and step 3 becomes "open the doc URL and confirm the signature matches."
If it doesn't, that's a bug — open an issue and SKF will republish the skill with a fresh provenance map (a new commit SHA for source skills, a fresh fetch for docs-only). Falsifiability isn't a feature; it's the whole deal.
Reference output: [oh-my-skills](https://github.com/armelhbobdad/oh-my-skills) — four Deep-tier skills compiled by SKF (cocoindex, cognee, Storybook v10, uitripled), each shipping its full audit trail in-repo. Scores range from 99.0% to 99.49%. Every claim walks to an upstream line in under 60 seconds. Serves as both the worked example for this section and ongoing proof that the pipeline does what it says.
Workflows end with a health check that files bug reports as GitHub issues (auto-deduped by fingerprint — re-reporting is safe); friction notes go to a local queue you can opt in to submit live. Please let workflows run to completion, or open an issue directly. Full details →
The docs are organized into three buckets — Why (start here), Try (do stuff), and Reference (look things up):
Why
Try
Reference
SKF builds on these excellent open-source tools:
| Tool | Role in SKF |
|---|---|
| agentskills.io | Skill specification and ecosystem standard |
| GitHub CLI | Source code access and repository intelligence (all tiers) |
| ast-grep | AST-based structural code extraction (Forge/Forge+/Deep tiers) |
| ast-grep MCP | MCP server for memory-efficient AST queries (recommended) |
| cocoindex-code | Semantic code search and file discovery pre-ranking (Forge+ tier) |
| QMD | Local hybrid search engine for knowledge indexing (Deep tier) |
| skill-check | Skill validation, auto-fix, quality scoring, and security scanning |
| Snyk Agent Scan | Security scanning for prompt injection and data exposure (optional) |
| tessl | Content quality review, actionability scoring, and AI judge evaluation |
| BMAD Method | Agent-workflow framework that SKF extends as a module |
See CONTRIBUTING.md for guidelines.
Past releases are documented in CHANGELOG.md.
MIT License — see LICENSE for details.
Skill Forge (SKF) — A standalone BMAD module for agent skill compilation.
See CONTRIBUTORS.md for contributor information.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.