claude-forge

Bootstrap the complete .claude/ directory structure for any new project with replicable templates, CLAUDE.md, rules, skills, agents, hooks, and settings. Use this skill whenever the user says "bootstrap project", "mount project structure", "setup claude code", "initialize .claude", "start new project", "monte a estrutura do projeto", "prepare project for claude code", "scaffold claude config", or any variation asking to set up Claude Code configuration for a new or existing codebase. Also trigger when the user asks to "create CLAUDE.md template", "setup skills", or wants a replicable project skeleton. Supports stack-specific variants including django, flask-next, go, laravel, node, python, react, and rust. Supports architecture presets: mvp (monolith, Supabase+Vercel), production-aws (multi-service, Terraform, AWS: VPC + RDS + ECS Fargate), or production-gcp (multi-service, Terraform, GCP: VPC + Cloud SQL + Cloud Run, WIF-based CI/CD).

Spec-driven project build using Agent Teams. Reads a SPEC.md file (or receives a feature description), creates a shared API contract, then spawns a multi-agent team to implement backend and frontend in parallel. Includes security validation and checkpoint creation on success. Use when the user says "build from spec", "implement the spec", "spec-build", "build this project", "monte o projeto a partir do spec", or wants to go from specification to working code using parallel agents.

Create a development checkpoint: run tests, commit clean state, tag with version, and save context summary for session continuity. Use when you want to mark a stable point in development before switching context, ending a session, or starting a risky change. Trigger phrases: "checkpoint", "save progress", "mark stable", "create checkpoint", "snapshot", "save state", "forge checkpoint".

Audit infrastructure configuration for security and best practices. Reviews Terraform, Docker, CI/CD pipelines, and cloud config for misconfigurations, overly permissive permissions, and missing security controls. Trigger phrases: "infra audit", "terraform review", "docker audit", "infrastructure review", "forge infra-audit", "check infra", "audit infrastructure".

Perform passive reconnaissance and attack surface mapping from the codebase. Identifies exposed endpoints, auth flows, input vectors, and potential attack paths for authorized security testing. For use in pentesting engagements, CTF, or internal security assessments only. Trigger phrases: "pentest recon", "attack surface", "map endpoints", "recon", "forge pentest-recon", "threat model", "attack surface mapping".

Run a comprehensive OWASP-based security audit on the codebase. Checks for injection, broken auth, sensitive data exposure, misconfigurations, and known vulnerable dependencies. Trigger phrases: "security audit", "owasp check", "security review", "vuln scan", "forge security-audit", "check security".

Stage changes, generate a conventional commit message, and commit.

[CUSTOMIZE] Describe what this skill does and WHEN Claude should auto-invoke it. Be specific about trigger phrases. Example: "Generate database migration files. Use when the user says 'create migration', 'add column', 'change schema', 'migrate', or asks to modify the database structure."

Investigate and fix a GitHub issue by number.

Review current branch diff against main for issues before merging.

Interview the user about a feature, then write a detailed spec to SPEC.md.