Modular skills architecture with trust model and security analyzer#6
Merged
initializ-mk merged 2 commits intomainfrom Feb 23, 2026
Merged
Modular skills architecture with trust model and security analyzer#6initializ-mk merged 2 commits intomainfrom
initializ-mk merged 2 commits intomainfrom
Conversation
Introduce integrity verification (SHA-256 checksums, manifests), Ed25519 signature support with keyring management, provenance tracking on SkillDescriptor, and a security analyzer with risk scoring, policy enforcement, and audit reporting. Integrate SecurityAnalysisStage into the build pipeline and add forge skills audit/sign/keygen CLI commands.
Align the default skills filename with project branding (SKILL.md). Add --embedded and --dir flags to `forge skills audit` for per-skill registry scanning.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
forge-core/into standaloneforge-skills/module with autodiscovery,SkillRegistryinterface, SKILL.md-per-subdirectory convention, embedded skill filesystem, parser, compiler, requirements aggregation, and env resolverSkillDescriptor) and security analyzer (deterministic risk scoring, configurable policy enforcement, audit report generation)SecurityAnalysisStagebetween skills compilation and requirements — writescompiled/security-audit.jsonartifact and blocks build on policy errorsforge skills audit [--format text|json],forge skills sign --key <path>,forge skills keygen <name>Test plan
go test ./...passes for all three modules (forge-core, forge-cli, forge-skills)golangci-lint runreports 0 issues across all modulesgofmt -wapplied to all source filesgo build ./forge-cli/cmd/forge/forge skills auditon a project with skills.md shows risk scores and policy checkforge skills audit --format jsonoutputs valid JSONforge skills keygen test-authorcreates key pair in~/.forge/keys/forge skills sign <skill-file> --key <key>creates.sigfileforge buildincludescompiled/security-audit.jsonin output